@abloatai/transaction 0.59.1 → 0.60.0

package/src/auth/apiKey.ts

@@ -17,15 +17,18 @@ import { classifyCredentialKind } from './credentialKind.js';
 import { ABLO_DEFAULT_BASE_URL } from './hostedEndpoints.js';
 import { normalizeAbloBaseUrl } from './baseUrl.js';
 import type { KeyEnvironment } from '../environment.js';
-import { isCredentialEndpoint, createEndpointCredentialResolver } from './credentialEndpoint.js';
+import { isCredentialEndpoint } from './credentialEndpoint.js';
 import {
   credentialToken,
   type CredentialProvider,
+  type CredentialProviderResult,
 } from './credentialResult.js';
+import type { SessionSource } from '../sessions/contract.js';
 import {
   assertBrowserSafety,
   protectBrowserCredentialProvider,
 } from './browserCredentialSafety.js';
+import { resolveSessionCredential } from '../sessions/source.js';
 export { assertBrowserSafety };
 
 /**
@@ -40,22 +43,18 @@ export type { CredentialProvider } from './credentialResult.js';
  * The client options that decide a credential.
  *
  * This is the ONE declaration of that set. The resolvers below read it, and the
- * transport configs that accept these options derive from it rather than listing
- * the fields again — a second list is how `authEndpoint` came to be supported at
- * runtime, named in an error message, and absent from the type a caller writes
- * against.
+ * transport configs that accept these options derive from it rather than
+ * listing the fields again.
  */
 export interface AuthClientOptions {
   readonly apiKey?: string | CredentialProvider | null;
-  /** A route that mints the token, instead of a key the process holds. */
-  readonly authEndpoint?: string | CredentialProvider | null;
+  /** A scoped session, its renewal provider, or a browser session endpoint. */
+  readonly session?: SessionSource | null;
   /** A token the caller already has, used as-is. */
   readonly authToken?: string | null;
   readonly baseURL?: string | null;
   readonly dangerouslyAllowBrowser?: boolean;
   readonly fetch?: typeof globalThis.fetch;
-  readonly authTimeoutMs?: number;
-  readonly allowCrossOriginAuthEndpoint?: boolean;
 }
 
 export interface AuthResolveInput {
@@ -83,45 +82,20 @@ export function readProcessEnv(): Record<string, string | undefined> {
 export function resolveApiKey(
   input: AuthResolveInput,
 ): string | CredentialProvider | null {
-  // `authEndpoint` is the option that names a session-mint route: a URL the
-  // client exchanges for a short-lived token, or an async resolver for custom
-  // exchanges. It is resolved into a `CredentialProvider` here — the single point
-  // shared by every client variant (WebSocket, HTTP, and protocol clients) — so
-  // every downstream consumer sees the same resolver and the credential
-  // lifecycle drives renewal off it.
-  const endpoint = input.options.authEndpoint;
   const configured = input.options.apiKey;
-  if (endpoint != null) {
-    if (configured != null) {
+  const session = input.options.session;
+  if (session != null) {
+    if (configured != null || input.options.authToken != null) {
       throw new AbloValidationError(
-        'Ablo: pass either `apiKey` (a key the process holds) or `authEndpoint` ' +
-          '(a route that mints the token) — not both; the client cannot know ' +
-          'which credential to use.',
-        { code: 'invalid_options', param: 'authEndpoint' },
+        'Ablo: pass `session`, `apiKey`, or `authToken` — not more than one.',
+        { code: 'invalid_options', param: 'session' },
       );
     }
-    if (typeof endpoint === 'function') {
-      return protectBrowserCredentialProvider(
-        endpoint,
-        input.options.dangerouslyAllowBrowser,
-      );
-    }
-    if (!isCredentialEndpoint(endpoint)) {
-      throw new AbloValidationError(
-        '`authEndpoint` expects a URL or path (e.g. \'/api/ablo-session\') or an ' +
-          'async resolver — a key string belongs in `apiKey`.',
-        { code: 'invalid_options', param: 'authEndpoint' },
-      );
-    }
-    return protectBrowserCredentialProvider(createEndpointCredentialResolver(endpoint, {
-      fetch: input.options.fetch,
-      timeoutMs: input.options.authTimeoutMs,
-      allowCrossOrigin: input.options.allowCrossOriginAuthEndpoint,
-    }), input.options.dangerouslyAllowBrowser);
+    return resolveSessionCredential(session, input.options);
   }
   if (typeof configured === 'string' && isCredentialEndpoint(configured)) {
     throw new AbloValidationError(
-      '`apiKey` no longer accepts an endpoint. Move this value to `authEndpoint`.',
+      '`apiKey` does not accept an endpoint. Use `session: { endpoint }`.',
       { code: 'invalid_options', param: 'apiKey' },
     );
   }
@@ -139,8 +113,8 @@ export function resolveApiKey(
  * needs: an async `() => token | null`, or `null` when auth is static — a plain
  * long-lived key string with no refresh, which is the common case.
  *
- * The short-lived per-user browser path passes a credential provider, and the
- * SDK then drives the whole credential lifecycle
+ * A renewable session or browser session endpoint resolves to a credential
+ * provider, and the SDK then drives the whole credential lifecycle
  * from it: mint-before-connect, the proactive refresh timer with its
  * wake/online/focus re-mint, and the reactive `credential_stale` re-mint. The
  * resolver follows the provider contract end to end: resolve a token,
@@ -434,8 +408,15 @@ export function rejectRemovedDatabaseUrlOption(options: object): void {
 export async function resolveApiKeyValue(
   apiKey: string | CredentialProvider | null,
 ): Promise<string | null> {
+  return credentialToken(await resolveCredentialValue(apiKey));
+}
+
+/** Resolve without discarding session expiry metadata needed by live clients. */
+export async function resolveCredentialValue(
+  apiKey: string | CredentialProvider | null,
+): Promise<CredentialProviderResult> {
   if (apiKey == null) return null;
-  if (typeof apiKey === 'function') return credentialToken(await apiKey());
+  if (typeof apiKey === 'function') return apiKey();
   return apiKey;
 }
 

package/src/auth/browserCredentialSafety.ts

@@ -42,7 +42,7 @@ export function protectBrowserCredentialProvider(
 function throwBrowserSecretError(): never {
   throw new AbloAuthenticationError(
     'A secret `sk_` credential reached the browser. Keep it server-side and ' +
-      'configure the browser with `authEndpoint` instead.',
+      'configure the browser with `session: { endpoint }` instead.',
     { code: 'browser_apikey_blocked' },
   );
 }

package/src/auth/capabilityLifecycle.ts

@@ -9,7 +9,8 @@ import type {
   RotateSessionParams,
   SessionRevocation,
   SessionRotation,
-} from '../client/resources/httpResources.js';
+} from '../sessions/contract.js';
+import { sessionScope } from '../sessions/contract.js';
 
 export const sessionRevocationResponseSchema = z.object({
   id: z.string().min(1),
@@ -166,7 +167,7 @@ export async function rotateCapability(
     token: parsed.data.token,
     expiresAt: parsed.data.expiresAt,
     organizationId: parsed.data.organizationId,
-    scope: parsed.data.scope,
+    scope: sessionScope(parsed.data.scope),
     rotatedFrom: {
       id: parsed.data.rotatedFrom.capabilityId,
       expiresAt: parsed.data.rotatedFrom.expiresAt,

package/src/auth/credentialEndpoint.ts

@@ -23,7 +23,7 @@ function assertEndpointOrigin(endpoint: string, allowCrossOrigin: boolean): void
   if (endpointOrigin !== window.location.origin) {
     throw new Error(
       'credential endpoint must be same-origin; set ' +
-        '`allowCrossOriginAuthEndpoint: true` only after configuring CORS and CSRF protection',
+        '`session.allowCrossOrigin: true` only after configuring CORS and CSRF protection',
     );
   }
 }

package/src/auth/credentialResult.ts

@@ -1,8 +1,10 @@
 import type { CredentialEndpointSuccess } from './credentialEndpointProtocol.js';
+import type { SessionCredential } from '../sessions/contract.js';
 
 export type CredentialProviderResult =
   | string
   | CredentialEndpointSuccess
+  | SessionCredential
   | null;
 
 /** Rotating secret provider or short-lived browser credential provider. */

package/src/claims/events.ts

@@ -37,8 +37,7 @@ export interface ClaimEvent {
     | 'queued'
     | 'granted'
     | 'lost'
-    | 'rejected'
-    | 'expired';
+    | 'rejected';
   claimId?: string;
   model?: string;
   id?: string;

package/src/client/ablo.ts

@@ -1,17 +1,16 @@
 /**
  * `Ablo` — the entry point to the coordination layer.
  *
- * The factory constructs the stateless client: typed model resources, commits,
- * claims, and session minting over request/response HTTP. It holds no socket,
- * no store, and no local copy of anything — the bearer credential is the
- * identity and the server resolves it on every request. This is the client a
- * server-side actor installs: an agent, a worker, a cron job, a route handler.
+ * The factory constructs the headless client: typed model resources, commits,
+ * and claims. API-key clients use request/response HTTP.
+ * Session clients use one reconnecting WebSocket by default; the session is
+ * the scoped identity and outlives any individual socket connection.
  *
  * ```ts
  * import { Ablo } from '@abloatai/ablo';
  * import { schema } from '../schema';
  *
- * const ablo = Ablo({ schema, apiKey: process.env.ABLO_API_KEY, transport: 'http' });
+ * const ablo = Ablo({ schema, apiKey: process.env.ABLO_API_KEY });
  * await ablo.items.update({ id: itemId, data: { status: 'done' } });
  * ```
  *
@@ -23,6 +22,7 @@
 import {
   createAbloHttpClient,
   type AbloHttpClient,
+  type AbloWebSocketClient,
 } from '../transport/http/client.js';
 import type { SchemaRecord } from '../schema/schema.js';
 import type { PublicAbloOptions } from './surface.js';
@@ -34,22 +34,32 @@ import type * as _Http from './resources/httpResources.js';
 /**
  * Create a coordination-layer client in one call.
  *
- * The core carries one transport today — request/response HTTP — so
- * `transport: 'http'` is accepted for symmetry with the reactive package's
- * factory and may be omitted. The duplex transport joins this slot when the
- * socket carve lands (ADR 0016, follow-up 3a).
+ * Transport follows identity by default: API keys use HTTP and sessions use a
+ * reconnecting WebSocket without changing the model, commit, or claim API.
  */
+export function Ablo<const S extends SchemaRecord>(
+  options: PublicAbloOptions<S> & { readonly transport: 'websocket' },
+): AbloWebSocketClient<S>;
+export function Ablo<const S extends SchemaRecord>(
+  options: PublicAbloOptions<S> & {
+    readonly session: NonNullable<PublicAbloOptions<S>['session']>;
+    readonly transport?: undefined;
+  },
+): AbloWebSocketClient<S>;
+export function Ablo<const S extends SchemaRecord>(
+  options: PublicAbloOptions<S>,
+): AbloHttpClient<S>;
 export function Ablo<const S extends SchemaRecord>(
   options: PublicAbloOptions<S>,
-): AbloHttpClient<S> {
+): AbloHttpClient<S> | AbloWebSocketClient<S> {
   return createAbloHttpClient(options);
 }
 
 // ─────────────────────────────────────────────────────────────────────
-//  Ablo namespace — type access via namespace dots for stateless callers
+//  Ablo namespace — type access via namespace dots for headless callers
 // ─────────────────────────────────────────────────────────────────────
 //
-// The stateless subset of the type namespace the reactive package hangs off
+// The headless subset of the type namespace the reactive package hangs off
 // its own `Ablo` export: every entry a consumer of THIS client would write
 // out (`Ablo.Activity`, `Ablo.Commit.Receipt`, and so on), and nothing that
 // needs a store or a socket behind it. The

package/src/client/resources/httpResources.ts

@@ -1,6 +1,6 @@
 /**
  * Shared resource types for the typed clients and private HTTP transport.
- * the commit and claim shapes, the session-mint params and resource, and the
+ * the commit and claim shapes, and the
  * {@link HttpClaimApi} derivation. This module holds only types and has no runtime
  * imports.
  */
@@ -38,15 +38,9 @@ import type { ModelTarget, ModelClaim } from '../../coordination/schema.js';
 export type { ModelTarget, ModelClaim };
 import type { ResolveClaimMeta } from '../../types/global.js';
 import type { ParticipantKind } from '../../types/participant.js';
-import type { SchemaRecord } from '../../schema/schema.js';
-import type { SyncGroupInput } from '../../schema/roles.js';
 // The capability vocabulary — `auth/capability.ts` owns what a grant is on both
 // axes, and these params are the surface a developer declares it through.
-import type {
-  CapabilityCan,
-  CapabilityOperation,
-  EffectiveAuthority,
-} from '../../auth/capability.js';
+import type { EffectiveAuthority } from '../../auth/capability.js';
 import type {
   Claim,
   ClaimStream,
@@ -496,169 +490,3 @@ export interface HttpTransportModel<
    */
   claim: HttpClaimApi<T, Fields>;
 }
-
-/** A single data operation a scoped **agent** session may perform on a model.
- *  The SDK-facing name for {@link CapabilityOperation}; the vocabulary itself is
- *  declared once, as a schema, in `auth/capability.ts`. */
-export type SessionOperation = CapabilityOperation;
-
-/** Parameters for minting an end-user session. Mints an `ek_` token.
- *  `user.id` is your end user's id from your
- *  own identity provider and becomes the session's `participantId`; Ablo does not
- *  model your users, so it is treated as an opaque string at the trust boundary. */
-export interface CreateUserSessionParams<S extends SchemaRecord> {
-  /** Your end user. `id` becomes the token's `participantId`. */
-  user: { id: string };
-  /** Mint the session into this organization instead of the key's own — for a
-   *  platform that serves many tenants from one backend. Requires the `sk_` key to
-   *  carry the `organization:act-as` scope; omit it for the normal
-   *  single-tenant case. */
-  organizationId?: string;
-  /** Resolve this session's schema from a shared project while its data stays
-   *  scoped to `organizationId`. Cross-organization mints default to the
-   *  platform key's own project, so most platforms can omit this. Specify it
-   *  only to override that default. Requires `organization:act-as`. */
-  schemaProject?: {
-    organizationId: string;
-    projectId: string;
-  };
-  /** Sync groups this session may subscribe to — typed (`'default'` or
-   *  `<namespace>:<id>`; build with `syncGroup(kind, id)` from
-   *  `@abloatai/transaction/schema`). Omit for the server default:
-   *  `[org:<your org>, user:<user.id>]`. */
-  syncGroups?: readonly SyncGroupInput[];
-  /** Required least-privilege grant. */
-  can: CapabilityCan<S>;
-  /** Token lifetime in seconds. Defaults to 900 (15 minutes). */
-  ttlSeconds?: number;
-  /** Opaque identity blob echoed back to the client as `ablo.user`. */
-  userMeta?: Record<string, unknown>;
-  agent?: never;
-}
-
-/** Mint params for a scoped **agent** session — mints a restricted `rk_` token
- *  gated to exactly the operations named in `can`. `can` is typed off your
- *  schema (no magic `'item.update'` strings): `{ Item: ['update'], Report: ['read'] }`
- *  — the SDK serializes each entry to the wire allowlist (`item.update`). */
-export interface CreateAgentSessionParams<S extends SchemaRecord> {
-  /** Your agent. `id` becomes the token's `participantId`. */
-  agent: { id: string };
-  /** The authenticated person who started this agent run. The backend holding
-   *  the secret key attests this identity, and every resulting delta records
-   *  the agent as actor plus this user as `onBehalfOf`. Persist the user id on
-   *  durable work before enqueueing it so a later worker can supply it here. */
-  onBehalfOf?: { readonly user: { readonly id: string } };
-  /** Per-model operation allowlist, typed against the schema's model names. */
-  can: CapabilityCan<S>;
-  /** Sync groups this session may subscribe to — typed (`'default'` or
-   *  `<namespace>:<id>`; build with `syncGroup(kind, id)` from
-   *  `@abloatai/transaction/schema`). Omit for the server default: the org
-   *  anchor (`org:<your org>`) + the agent's own anchor. */
-  syncGroups?: readonly SyncGroupInput[];
-  /** Token lifetime in seconds. Defaults to 900 (15 minutes). */
-  ttlSeconds?: number;
-  /** Opaque identity blob echoed back to the client as `ablo.agent`. */
-  userMeta?: Record<string, unknown>;
-  user?: never;
-}
-
-/** Params for {@link Ablo.sessions}.create — a discriminated union: pass
- *  `{ user, can }` for an end-user session (`ek_`) or `{ agent, can }`
- *  for a scoped agent session (`rk_`). */
-export type CreateSessionParams<S extends SchemaRecord> =
-  | CreateUserSessionParams<S>
-  | CreateAgentSessionParams<S>;
-
-/** Params for {@link Ablo.agents}.create — a flattened agent descriptor (no
- *  `{ agent }` discriminator: `agents.create` only ever mints an agent). Unlike
- *  {@link CreateSessionParams} it resolves to a connected, scoped {@link Ablo}
- *  client rather than a raw token. */
-export interface CreateAgentClientParams<S extends SchemaRecord> {
-  /** The wire participant identity (`agent:<id>`) that claim exclusion and the
-   *  FIFO queue gate on. Omit it to get a fresh random id — a distinct, independent
-   *  participant, which is the default and what you want for concurrent agents.
-   *  Pass a stable string only when one logical agent must re-attach to its own
-   *  held claims across reconnects or restarts. */
-  id?: string;
-  /** The authenticated person who started this run. Preserving it on durable
-   *  work and supplying it here gives every write dual-principal attribution. */
-  onBehalfOf?: { readonly user: { readonly id: string } };
-  /** A human-readable label for logs and attribution (carried in `userMeta.name`).
-   *  It is independent of `id`: two agents that share a `name` still receive
-   *  distinct ids and coordinate as separate participants — `name` never derives or
-   *  collapses identity. */
-  name?: string;
-  /** Per-model operation allowlist, typed against the schema's model names. */
-  can: CapabilityCan<S>;
-  /** Sync groups this agent may subscribe to — typed (`'default'` or
-   *  `<namespace>:<id>`). Omit for the server default (org anchor + the
-   *  agent's own anchor). */
-  syncGroups?: readonly SyncGroupInput[];
-  /** Token lifetime in seconds. Defaults to 900 (15 minutes); the returned client
-   *  re-mints before expiry, so a long-running agent never handles rotation
-   *  itself. */
-  ttlSeconds?: number;
-  /** Extra opaque identity blob echoed on the session scope. Merged with
-   *  `name` (the `name` param wins if you also set `userMeta.name`). */
-  userMeta?: Record<string, unknown>;
-}
-
-/** A minted session. `token` is the secret the holder presents as its bearer. */
-export interface AbloSession {
-  object: 'session';
-  /** Stable id of the minted credential (for revocation). */
-  id: string;
-  /** The short-lived session token — `ek_` for a `{ user }` session, `rk_`
-   *  for an `{ agent }` session. Hand this to the participant's runtime. */
-  token: string;
-  /** ISO-8601 expiry. */
-  expiresAt: string;
-  organizationId: string;
-  /** The grant this token carries, on both axes — the same shape the key row
-   *  stores and the gates enforce. */
-  scope: EffectiveAuthority;
-  userMeta: Record<string, unknown>;
-}
-
-/** Result of revoking a user or agent session. */
-export interface SessionRevocation {
-  id: string;
-  deleted: true;
-  activeSessionsClosed: number;
-}
-
-/** Rotation-with-overlap result for an agent session. */
-export interface SessionRotation {
-  id: string;
-  token: string;
-  expiresAt: string | null;
-  organizationId: string;
-  scope: EffectiveAuthority;
-  rotatedFrom: {
-    id: string;
-    expiresAt: string;
-  };
-}
-
-export interface RevokeSessionParams {
-  id: string;
-}
-
-export interface RotateSessionParams {
-  id: string;
-  /** How long the previous token remains valid. Defaults to 24 hours. */
-  graceSeconds?: number;
-  /** Optional lifetime for the replacement token. */
-  ttlSeconds?: number;
-}
-
-export interface SessionResource<S extends SchemaRecord> {
-  create(params: CreateSessionParams<S>): Promise<AbloSession>;
-  /** Immediately revoke an `ek_` or `rk_` session and close live connections. */
-  revoke(params: RevokeSessionParams): Promise<SessionRevocation>;
-  /**
-   * Rotate an agent `rk_` session with an overlap window. Browser `ek_`
-   * sessions rotate through their `authEndpoint` instead.
-   */
-  rotate(params: RotateSessionParams): Promise<SessionRotation>;
-}

package/src/client/resources/modelOperations.ts

@@ -623,13 +623,3 @@ export interface ModelDeleteParams<T, Fields = T>
   readonly id: string;
   readonly claim?: Claim<T> | ClaimTargetOptions<Fields> | null;
 }
-
-/** Options for the WebSocket-only `ablo.<model>.join(ids, options?)`. */
-export interface JoinOptions {
-  /**
-   * Lease TTL for the underlying presence claim — the participant
-   * auto-releases after this if the holder dies. Compact duration string
-   * (`'5m'`) or ms number, mirroring the claim `ttl`.
-   */
-  ttl?: Duration;
-}

package/src/client/surface.ts

@@ -14,19 +14,17 @@ export type PublicAbloOptions<S extends SchemaRecord = SchemaRecord> = Omit<
   AbloHttpClientOptions<S>,
   'onCommitReceipt' | 'transport'
 > & {
-  readonly transport?: 'http';
+  readonly transport?: 'http' | 'websocket';
 };
 
 export const PUBLIC_ABLO_OPTION_KEYS = [
   'schema',
   'apiKey',
-  'authEndpoint',
+  'session',
   'authToken',
   'baseURL',
   'dangerouslyAllowBrowser',
   'fetch',
-  'authTimeoutMs',
-  'allowCrossOriginAuthEndpoint',
   'bootstrapBaseUrl',
   'defaultHeaders',
   'defaultQuery',
@@ -36,6 +34,13 @@ export const PUBLIC_ABLO_OPTION_KEYS = [
   'commitOutboxScope',
   'transport',
   'timeoutMs',
+  'groups',
+  'collaborationEvents',
+  'cursorStore',
+  'cursorKey',
+  'reconnectDelay',
+  'maxReconnectDelay',
+  'connectTimeoutMs',
 ] as const;
 
 type Equal<A, B> =

package/src/commit/recordRuntime.ts

@@ -21,8 +21,9 @@ interface WebSocketCommitObservation {
   readonly operations: readonly {
     readonly type: string;
     readonly model: string;
-    readonly id: string;
-    readonly input?: Record<string, unknown>;
+    readonly id: string | null;
+    readonly input?: Record<string, unknown> | null;
+    readonly where?: Record<string, unknown> | null;
     readonly claimId?: string | null;
     readonly readAt?: number | null;
     readonly fenceToken?: number | null;
@@ -149,6 +150,7 @@ export function recordWebSocketCommitReceipt(
     model: operation.model,
     id: operation.id,
     ...(operation.input ? { data: operation.input } : {}),
+    ...(operation.where ? { where: operation.where } : {}),
     ...(operation.claimId ? { claimId: operation.claimId } : {}),
     ...(typeof operation.readAt === 'number' ? { readAt: operation.readAt } : {}),
     ...(typeof operation.fenceToken === 'number'

package/src/coordination/index.ts

@@ -41,7 +41,6 @@ export {
   claimQueuedSchema,
   claimQueueSchema,
   claimQueueEntrySchema,
-  claimExpiredSchema,
   claimEventReasonSchema,
   modelTargetSchema,
   // The one claim record, and the peer-visible projection of it.
@@ -55,11 +54,8 @@ export {
   claimHeartbeatAckPayloadSchema,
   claimHeartbeatBatchPayloadSchema,
   claimHeartbeatBatchAckPayloadSchema,
-  // Read interest — what a connection receives, leased (`claim`/`release`,
-  // the frames behind `join`) and unleased (`update_subscription`).
+  // Read interest — what a connection receives.
   MAX_FRAME_SYNC_GROUPS,
-  participantClaimPayloadSchema,
-  participantReleasePayloadSchema,
   updateSubscriptionPayloadSchema,
   subscriptionAckPayloadSchema,
   // Commit operation — carries the optimistic write-guard
@@ -96,7 +92,6 @@ export type {
   ClaimQueued,
   ClaimQueue,
   ClaimQueueEntry,
-  ClaimExpired,
   ClaimEventReason,
   ModelTarget,
   ClaimRecord,
@@ -109,9 +104,7 @@ export type {
   ClaimHeartbeatAckPayload,
   ClaimHeartbeatBatchPayload,
   ClaimHeartbeatBatchAckPayload,
-  // Read interest — leased and unleased
-  ParticipantClaimPayload,
-  ParticipantReleasePayload,
+  // Read interest
   UpdateSubscriptionPayload,
   SubscriptionAckPayload,
   // Commit operation — carries the optimistic write-guard