@almadar/runtime 6.62.0 → 6.64.0

package/dist/{OrbitalServerRuntime-CZHHxo_A.d.ts → OrbitalServerRuntime-DOJDoqXu.d.ts}

@@ -767,6 +767,11 @@ declare function preprocessSchema(schema: OrbitalSchema, options: PreprocessOpti
  *
  * - `persistent` entities share the same collection
  * - `runtime` entities get isolated collections per orbital
+ *
+ * NOTE: the runtime's own store keying does NOT go through this helper —
+ * `MockPersistenceAdapter` resolves entity → store via its declared
+ * `collection` directly (collection-keyed stores, 2026-08-29). This stays
+ * exported for external consumers computing display/derived names only.
  */
 declare function getIsolatedCollectionName(orbitalName: string, entitySharing: EntitySharingMap): string;
 /**
@@ -1411,6 +1416,29 @@ declare class OrbitalServerRuntime {
      * instead of re-seeding.
      */
     setDefaultUser(user: UserContext | undefined): void;
+    /** setDefaultUser can land before register() finishes resolving the schema
+     *  (a dev host pins a persona right after boot). An ungated restamp there
+     *  would hand a read-only persona authorship of drafts, so the restamp is
+     *  DEFERRED until the schema exists — register()/registerSync() flush it. */
+    private pendingOwnerRestamp;
+    /**
+     * Re-point the mock seeder's owner stamps at `user`. The adapter's
+     * installed owner gate (see installOwnerGate) decides per row whether the
+     * persona could have CREATED it — a reader keeps seeing the store's
+     * published face instead of inheriting draft ownership from the demo
+     * stamper. Deferred when the schema (and so the gate) isn't resolved yet.
+     */
+    private restampOwnerGated;
+    /**
+     * Install the schema's `@create` directives as the mock seeder's owner
+     * gate — the single authority on who may author a row. Consulted by BOTH
+     * `restampOwner` (persona switches) and `seed()` (a client connect
+     * re-registers, and the deterministic reseed re-stamps with the current
+     * ownerId — gating only the switch path would leak right there). Reads the
+     * CURRENT default user at evaluation time so one installation covers every
+     * later switch. Then flushes any switch that arrived before the schema.
+     */
+    private installOwnerGate;
     /** The viewer a dev host is currently presenting the app as. */
     getDefaultUser(): UserContext | undefined;
     /**

package/dist/OrbitalServerRuntime.d.ts

@@ -1,4 +1,4 @@
 import 'express';
-export { F as ClientEffectTuple, G as ClientNavigateBackTuple, H as ClientNavigateTuple, J as ClientNotifyTuple, K as ClientRenderUITuple, M as EffectResult, e as InMemoryPersistence, N as LiveBroadcastItem, Q as LoaderConfig, O as OrbitalEventRequest, f as OrbitalEventResponse, T as OrbitalServerRuntime, g as OrbitalServerRuntimeConfig, P as PersistenceAdapter, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, V as RuntimeTraitTick, p as collectDeclaredConfigDefaults, W as createOrbitalServerRuntime } from './OrbitalServerRuntime-CZHHxo_A.js';
+export { F as ClientEffectTuple, G as ClientNavigateBackTuple, H as ClientNavigateTuple, J as ClientNotifyTuple, K as ClientRenderUITuple, M as EffectResult, e as InMemoryPersistence, N as LiveBroadcastItem, Q as LoaderConfig, O as OrbitalEventRequest, f as OrbitalEventResponse, T as OrbitalServerRuntime, g as OrbitalServerRuntimeConfig, P as PersistenceAdapter, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, V as RuntimeTraitTick, p as collectDeclaredConfigDefaults, W as createOrbitalServerRuntime } from './OrbitalServerRuntime-DOJDoqXu.js';
 import './types-BaD_ox7e.js';
 import '@almadar/core';

package/dist/OrbitalServerRuntime.js

@@ -1,7 +1,7 @@
-import { createTickScheduler, EventBus, createUnifiedLoader, MockPersistenceAdapter, InMemoryPersistence, preprocessSchema, normalizeCallSiteConfigToValues, StateMachineManager, parseDurationString, validateEventPayload, formatPayloadValidationError, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, EffectExecutor } from './chunk-MEBKFZC4.js';
-export { InMemoryPersistence, collectDeclaredConfigDefaults } from './chunk-MEBKFZC4.js';
+import { createTickScheduler, EventBus, createUnifiedLoader, MockPersistenceAdapter, InMemoryPersistence, preprocessSchema, normalizeCallSiteConfigToValues, StateMachineManager, parseDurationString, validateEventPayload, formatPayloadValidationError, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, EffectExecutor } from './chunk-IFSFX43J.js';
+export { InMemoryPersistence, collectDeclaredConfigDefaults } from './chunk-IFSFX43J.js';
 import { isValidCronExpression } from './chunk-OU3ITB5S.js';
-import { createContextFromBindings, resolveCallSitePayloadCaptures, applyRowAccess, checkMutationAccess, accessDeniedMessage } from './chunk-ZJ62H3ES.js';
+import { createContextFromBindings, checkMutationAccess, resolveCallSitePayloadCaptures, applyRowAccess, accessDeniedMessage } from './chunk-ZJ62H3ES.js';
 import './chunk-T4VDAB4C.js';
 import './chunk-SCRAHWOC.js';
 import './chunk-MLKGABMK.js';
@@ -9,7 +9,7 @@ import { createLogger } from '@almadar/logger';
 import * as nodeModule from 'module';
 import { evaluateListenPayloadExpr, evaluateGuard, evaluate } from '@almadar/evaluator';
 import { DEFAULT_VIEWER, buildResolvedTraitConfigs, isInlineTrait, isEntityCall, applyListenPayloadMapping, personaFromIdentityRow, normalizeUserContext, isRuntimeEntity, isPageReference } from '@almadar/core';
-import { ownerFieldsFromSchema, identityEntityName, entityAccessPolicies } from '@almadar/core/mock';
+import { ownerFieldsFromSchema, identityEntityName, entityAccessPoliciesByStoreKey, entityAccessPolicies } from '@almadar/core/mock';
 import { getPatternFieldsContract } from '@almadar/core/patterns';
 
 // src/identity/routing.ts
@@ -355,6 +355,7 @@ var OrbitalServerRuntime = class {
     this.setupTicks();
     this.resolvedSchema = schema;
     this.resolvedTraitConfigs = buildResolvedTraitConfigs(schema);
+    this.installOwnerGate();
   }
   /**
    * Teach the mock seeder which columns hold the viewer's id, derived from the
@@ -391,7 +392,7 @@ var OrbitalServerRuntime = class {
     this.setupTicks();
     this.resolvedSchema = schema;
     this.resolvedTraitConfigs = buildResolvedTraitConfigs(schema);
-    this.applyIdentityOwnerFields(schema);
+    this.installOwnerGate();
   }
   /**
    * Returns the schema that this runtime is currently executing, post-
@@ -707,6 +708,7 @@ var OrbitalServerRuntime = class {
         this.persistence.registerEntity({
           name: entity.name,
           id: entity.id,
+          collection: entity.collection,
           fields,
           persistence: entity.persistence
         });
@@ -727,6 +729,7 @@ var OrbitalServerRuntime = class {
         this.persistence.registerEntity({
           name: auxEntity.name,
           id: auxEntity.id,
+          collection: auxEntity.collection,
           fields: auxFields,
           persistence: auxEntity.persistence
         });
@@ -1015,10 +1018,25 @@ var OrbitalServerRuntime = class {
         this.persistence.registerEntity({
           name: entity.name,
           id: entity.id,
+          collection: entity.collection,
           fields,
           persistence: entity.persistence
         });
       }
+      for (const auxRef of registered.schema.auxiliaryEntities ?? []) {
+        if (typeof auxRef === "string" || isEntityCall(auxRef)) continue;
+        if (!auxRef.name || !auxRef.fields) continue;
+        const auxFields = auxRef.fields.filter(
+          (f) => typeof f.name === "string" && f.name.length > 0
+        );
+        this.persistence.registerEntity({
+          name: auxRef.name,
+          id: auxRef.id,
+          collection: auxRef.collection,
+          fields: auxFields,
+          persistence: auxRef.persistence
+        });
+      }
     }
   }
   /**
@@ -1048,7 +1066,55 @@ var OrbitalServerRuntime = class {
     const previousId = this.config.defaultUser?.id;
     this.config.defaultUser = user;
     if (this.persistence instanceof MockPersistenceAdapter && user?.id !== void 0 && user.id !== previousId) {
-      this.persistence.restampOwner(user.id);
+      this.restampOwnerGated(user);
+    }
+  }
+  /** setDefaultUser can land before register() finishes resolving the schema
+   *  (a dev host pins a persona right after boot). An ungated restamp there
+   *  would hand a read-only persona authorship of drafts, so the restamp is
+   *  DEFERRED until the schema exists — register()/registerSync() flush it. */
+  pendingOwnerRestamp = false;
+  /**
+   * Re-point the mock seeder's owner stamps at `user`. The adapter's
+   * installed owner gate (see installOwnerGate) decides per row whether the
+   * persona could have CREATED it — a reader keeps seeing the store's
+   * published face instead of inheriting draft ownership from the demo
+   * stamper. Deferred when the schema (and so the gate) isn't resolved yet.
+   */
+  restampOwnerGated(user) {
+    if (!(this.persistence instanceof MockPersistenceAdapter)) return;
+    if (!this.resolvedSchema) {
+      this.pendingOwnerRestamp = true;
+      return;
+    }
+    this.persistence.restampOwner(user.id);
+  }
+  /**
+   * Install the schema's `@create` directives as the mock seeder's owner
+   * gate — the single authority on who may author a row. Consulted by BOTH
+   * `restampOwner` (persona switches) and `seed()` (a client connect
+   * re-registers, and the deterministic reseed re-stamps with the current
+   * ownerId — gating only the switch path would leak right there). Reads the
+   * CURRENT default user at evaluation time so one installation covers every
+   * later switch. Then flushes any switch that arrived before the schema.
+   */
+  installOwnerGate() {
+    if (!(this.persistence instanceof MockPersistenceAdapter) || !this.resolvedSchema) return;
+    const policiesByStore = entityAccessPoliciesByStoreKey(this.resolvedSchema);
+    this.persistence.setOwnerGate((storeKey, candidateRow) => {
+      const user = this.config.defaultUser;
+      if (!user) return true;
+      return checkMutationAccess(candidateRow, policiesByStore.get(storeKey)?.create, { user });
+    });
+    this.persistence.setOwnerCandidateGate((storeKey, candidateRow, candidateIdentityRow) => {
+      const persona = personaFromIdentityRow(candidateIdentityRow);
+      if (!persona) return false;
+      return checkMutationAccess(candidateRow, policiesByStore.get(storeKey)?.create, { user: persona });
+    });
+    if (this.pendingOwnerRestamp) {
+      this.pendingOwnerRestamp = false;
+      const user = this.config.defaultUser;
+      if (user?.id !== void 0) this.restampOwnerGated(user);
     }
   }
   /** The viewer a dev host is currently presenting the app as. */

package/dist/{chunk-MEBKFZC4.js → chunk-IFSFX43J.js}

@@ -355,7 +355,7 @@ function processEvent(options) {
   let lastFailedGuardTransition;
   for (const transition of candidates) {
     smLog.debug("processEvent", { trait: trait.name, event: normalizedEvent, currentState: traitState.currentState, to: transition.to });
-    if (!transition.guard) {
+    if (transition.guard === void 0 || transition.guard === null) {
       return {
         executed: true,
         newState: transition.to,
@@ -2128,12 +2128,24 @@ var mockLog = createLogger("almadar:runtime:mock");
 var DEFAULT_MOCK_SEED = 42;
 var SEED_REFERENCE_TIMESTAMP = "2024-01-01T00:00:00.000Z";
 var MS_PER_DAY = 864e5;
+function isRelationField(field) {
+  return field.type === "relation";
+}
+function stampedCellKey(entity, id, column) {
+  return `${entity}\0${id}\0${column}`;
+}
 var MockPersistenceAdapter = class _MockPersistenceAdapter {
   stores = /* @__PURE__ */ new Map();
   schemas = /* @__PURE__ */ new Map();
   idCounters = /* @__PURE__ */ new Map();
-  /** entityId -> normalized store name, so relation lookups can prefer the id sibling over `relation.entity` name-matching. */
+  /** entityId -> store key, so relation lookups can prefer the id sibling over `relation.entity` name-matching. */
   storeNameById = /* @__PURE__ */ new Map();
+  /** normalized entity name -> store key (the declared collection, else the name).
+   *  Entities sharing a `persistent:` collection resolve to the same store. */
+  storeKeyByEntity = /* @__PURE__ */ new Map();
+  /** store key -> the first registrant's entity name, used as the minted-id label
+   *  so rows in a shared collection carry one consistent id family. */
+  idLabelByStoreKey = /* @__PURE__ */ new Map();
   config;
   /**
    * Every (entity, row id, column) cell `seed()` stamped with `config.ownerId`.
@@ -2185,21 +2197,108 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
    * No-op when there is no new id, or it matches the current one — an
    * anonymous switch (`newOwnerId === undefined`) leaves existing stamps as
    * they are rather than clearing a non-nullable owner column.
+   *
+   * Both this re-labeling AND `seed()`'s original stamping consult the
+   * `ownerGate` hook (see `setOwnerGate`) — a re-register reseeds identical
+   * rows, so gating only the restamp path leaks the moment a client
+   * connects and the deterministic reseed stamps with the updated ownerId.
    */
   restampOwner(newOwnerId) {
     const oldOwnerId = this.config.ownerId;
     this.config.ownerId = newOwnerId;
     if (!newOwnerId || newOwnerId === oldOwnerId) return;
+    let skipped = 0;
+    let fallbackStamps = 0;
     for (const cell of this.ownerStampedCells) {
       const row = this.stores.get(cell.entity)?.get(cell.id);
-      if (row) row[cell.column] = newOwnerId;
+      if (!row) continue;
+      if (this.ownerGate && !this.ownerGate(cell.entity, { ...row, [cell.column]: newOwnerId })) {
+        const fallbackId = this.firstEligibleOwner(cell.entity, cell.column, row);
+        if (fallbackId === void 0) {
+          skipped++;
+          continue;
+        }
+        row[cell.column] = fallbackId;
+        fallbackStamps++;
+        continue;
+      }
+      row[cell.column] = newOwnerId;
     }
     mockLog.debug("mock:owner-restamped", {
       from: oldOwnerId,
       to: newOwnerId,
-      cells: this.ownerStampedCells.length
+      cells: this.ownerStampedCells.length,
+      skipped,
+      fallbackStamps
     });
   }
+  /**
+   * The host's answer to "may the current viewer OWN this row?" — evaluated
+   * against the candidate row with the owner column already re-pointed,
+   * `storeKey` being the collection key the stores are keyed by. The runtime
+   * installs the registered schema's `@create` directive here (the single
+   * authority on who authors; no role heuristics), so a read-only persona
+   * never inherits authorship of drafts from the demo stamper — neither on a
+   * persona switch (`restampOwner`) nor on a deterministic reseed (`seed`).
+   * Absent hook = stamp unconditionally (pre-role-model behavior).
+   */
+  ownerGate;
+  setOwnerGate(gate) {
+    this.ownerGate = gate;
+  }
+  /**
+   * The host's answer to "may THIS identity row own this candidate row?" —
+   * evaluated per candidate rather than against the fixed default viewer, so
+   * `linkRelationFields` and the eligible-owner fallback (see
+   * `firstEligibleOwner`) can pick a policy-valid owner from the whole
+   * identity roster instead of only ever checking the current default user.
+   * Absent hook = no candidate filtering (pre-role-model behavior).
+   */
+  ownerCandidateGate;
+  setOwnerCandidateGate(gate) {
+    this.ownerCandidateGate = gate;
+  }
+  /**
+   * The store an owner column's relation field targets, resolved the same
+   * way `linkRelationFields` resolves any relation target (id sibling wins
+   * over the `entity` name string) — but keyed by STORE, mirroring that
+   * method's first-declarer-per-collection rule, so `seed()` and
+   * `restampOwner()` can find it before a `linkRelationFields` pass has run
+   * this registration. Undefined when no registered schema on `storeKey`
+   * declares `column` as a relation field.
+   */
+  resolveOwnerColumnTargetStore(storeKey, column) {
+    for (const [normalizedName, schema] of this.schemas) {
+      if ((this.storeKeyByEntity.get(normalizedName) ?? normalizedName) !== storeKey) continue;
+      const field = schema.fields.find((f) => f.name === column);
+      if (field && isRelationField(field)) {
+        return (field.relation.entityId && this.storeNameById.get(field.relation.entityId)) ?? this.resolveStoreKey(field.relation.entity);
+      }
+    }
+    return void 0;
+  }
+  /**
+   * The first identity-store row (seed order) whose persona is eligible, per
+   * the installed `ownerCandidateGate`, to own `row`'s `column` in `storeKey`
+   * — the deterministic replacement for "skip the stamp" when the CURRENT
+   * viewer fails the `@create` policy (e.g. a reader-default persona against
+   * an author|reviewer-only policy). Undefined when no gate is installed, the
+   * column isn't a resolvable relation, or no identity row is eligible — the
+   * caller keeps today's skip behavior in that case.
+   */
+  firstEligibleOwner(storeKey, column, row) {
+    if (!this.ownerCandidateGate) return void 0;
+    const identityStoreKey = this.resolveOwnerColumnTargetStore(storeKey, column);
+    const identityStore = identityStoreKey ? this.stores.get(identityStoreKey) : void 0;
+    if (!identityStore) return void 0;
+    for (const identityRow of identityStore.values()) {
+      const candidateId = identityRow["id"];
+      if (this.ownerCandidateGate(storeKey, { ...row, [column]: candidateId }, identityRow)) {
+        return candidateId;
+      }
+    }
+    return void 0;
+  }
   /** Re-anchor the PRNG to the configured seed. Called before every
    *  re-seed loop so identical reseed sequences produce identical rows
    *  (timestamps + generated fields). Without this, the first
@@ -2213,19 +2312,27 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
   // ============================================================================
   // Store Management
   // ============================================================================
-  getStore(entityName) {
+  /** Resolve an entity name to its store key: the declared collection when the
+   *  entity is registered, the lowercased name otherwise (unregistered ad-hoc
+   *  creates keep working). */
+  resolveStoreKey(entityName) {
     const normalized = entityName.toLowerCase();
-    if (!this.stores.has(normalized)) {
-      this.stores.set(normalized, /* @__PURE__ */ new Map());
-      this.idCounters.set(normalized, 0);
+    return this.storeKeyByEntity.get(normalized) ?? normalized;
+  }
+  getStore(entityName) {
+    const key = this.resolveStoreKey(entityName);
+    if (!this.stores.has(key)) {
+      this.stores.set(key, /* @__PURE__ */ new Map());
+      this.idCounters.set(key, 0);
     }
-    return this.stores.get(normalized);
+    return this.stores.get(key);
   }
   nextId(entityName) {
-    const normalized = entityName.toLowerCase();
-    const counter = (this.idCounters.get(normalized) ?? 0) + 1;
-    this.idCounters.set(normalized, counter);
-    return `${this.capitalizeFirst(entityName)} Id ${counter}`;
+    const key = this.resolveStoreKey(entityName);
+    const counter = (this.idCounters.get(key) ?? 0) + 1;
+    this.idCounters.set(key, counter);
+    const label = this.idLabelByStoreKey.get(key) ?? entityName;
+    return `${this.capitalizeFirst(label)} Id ${counter}`;
   }
   // ============================================================================
   // Schema & Seeding
@@ -2237,12 +2344,20 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
    */
   registerEntity(schema, seedCount) {
     const normalized = schema.name.toLowerCase();
+    const storeKey = (schema.collection ?? schema.name).toLowerCase();
+    this.storeKeyByEntity.set(normalized, storeKey);
+    if (!this.idLabelByStoreKey.has(storeKey)) {
+      this.idLabelByStoreKey.set(storeKey, schema.name);
+    }
     this.schemas.set(normalized, schema);
     if (schema.id) {
-      this.storeNameById.set(schema.id, normalized);
+      this.storeNameById.set(schema.id, storeKey);
     }
+    const alreadySeeded = (this.stores.get(storeKey)?.size ?? 0) > 0;
     if (schema.seedData && schema.seedData.length > 0) {
       this.seedFromInstances(schema.name, schema.seedData);
+    } else if (alreadySeeded) {
+      this.backfillFields(storeKey, schema);
     } else {
       const requested = seedCount ?? this.config.defaultSeedCount ?? 6;
       const count = sampleRowCount(
@@ -2261,36 +2376,81 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
    * of nested-tree atoms (e.g. std-thread-comments-linear with ThreadPost.
    * replies → [ThreadPost]) render empty reply cards.
    *
-   * For self-referential relations, each row gets 2–4 sibling IDs (excluding
-   * self). For cross-entity relations, IDs are picked from the target store.
-   * The runtime caps recursion at depth=2 in `populateRelations`, so
-   * grandparent-of-self cycles render two levels deep then stop.
+   * Cross-entity relations pick random IDs from the target store. A
+   * SELF-referential `one`-cardinality relation (a parent column like
+   * `Tag.parentId : Tag`) is linked deterministically instead: row 0 stays a
+   * root (`""`) and row *i* parents to row ⌊(i−1)/2⌋ — a proper forest with
+   * real roots and no cycles, so tree views and `parentId = ""` root fetches
+   * render sensibly. Self-referential `many` relations keep the 2–4 random
+   * sibling IDs (excluding self). The runtime caps recursion at depth=2 in
+   * `populateRelations`, so deep chains render two levels then stop.
+   *
+   * Entities sharing a collection are linked once per STORE, over the union
+   * of their declared relation fields (first declarer of a field name wins).
    */
   linkRelationFields() {
+    const relationFieldsByStore = /* @__PURE__ */ new Map();
     for (const [normalizedName, schema] of this.schemas) {
-      const store = this.stores.get(normalizedName);
-      if (!store) continue;
-      const relationFields = schema.fields.filter(
-        (f) => f.type === "relation"
-      );
-      if (relationFields.length === 0) continue;
-      for (const row of store.values()) {
-        for (const field of relationFields) {
-          if (this.config.ownerId !== void 0 && row[field.name] === this.config.ownerId) {
+      const storeKey = this.storeKeyByEntity.get(normalizedName) ?? normalizedName;
+      let fieldMap = relationFieldsByStore.get(storeKey);
+      if (!fieldMap) {
+        fieldMap = /* @__PURE__ */ new Map();
+        relationFieldsByStore.set(storeKey, fieldMap);
+      }
+      for (const f of schema.fields) {
+        if (isRelationField(f) && !fieldMap.has(f.name)) {
+          fieldMap.set(f.name, f);
+        }
+      }
+    }
+    const ownerColumnsByStore = /* @__PURE__ */ new Map();
+    for (const { entity, field } of this.parsedOwnerFields()) {
+      const storeKey = this.resolveStoreKey(entity);
+      const set = ownerColumnsByStore.get(storeKey) ?? /* @__PURE__ */ new Set();
+      set.add(field);
+      ownerColumnsByStore.set(storeKey, set);
+    }
+    const stampedCellKeys = new Set(
+      this.ownerStampedCells.map((cell) => stampedCellKey(cell.entity, cell.id, cell.column))
+    );
+    for (const [storeKey, fieldMap] of relationFieldsByStore) {
+      const store = this.stores.get(storeKey);
+      if (!store || fieldMap.size === 0) continue;
+      const rows = [...store.values()];
+      const ownerColumns = ownerColumnsByStore.get(storeKey);
+      for (const field of fieldMap.values()) {
+        const isOwnerColumn = ownerColumns?.has(field.name) ?? false;
+        const targetKey = (field.relation.entityId && this.storeNameById.get(field.relation.entityId)) ?? this.resolveStoreKey(field.relation.entity);
+        const targetStore = this.stores.get(targetKey);
+        if (!targetStore || targetStore.size === 0) continue;
+        const sameStore = targetStore === store;
+        const cardinality = field.relation.cardinality ?? "many";
+        if (sameStore && (cardinality === "one" || cardinality === "many-to-one")) {
+          rows.forEach((row, i) => {
+            if (this.config.ownerId !== void 0 && row[field.name] === this.config.ownerId || stampedCellKeys.has(stampedCellKey(storeKey, row["id"], field.name))) {
+              return;
+            }
+            row[field.name] = i === 0 ? "" : rows[Math.floor((i - 1) / 2)]["id"];
+          });
+          continue;
+        }
+        for (const row of rows) {
+          const selfId = row["id"];
+          if (this.config.ownerId !== void 0 && row[field.name] === this.config.ownerId || stampedCellKeys.has(stampedCellKey(storeKey, selfId, field.name))) {
             continue;
           }
-          const targetNormalized = (field.relation.entityId && this.storeNameById.get(field.relation.entityId)) ?? field.relation.entity.toLowerCase();
-          const targetStore = this.stores.get(targetNormalized);
-          if (!targetStore || targetStore.size === 0) continue;
-          const selfId = row["id"];
-          const sameStore = targetStore === store;
-          const eligible = [];
+          let eligible = [];
           for (const id of targetStore.keys()) {
             if (sameStore && id === selfId) continue;
             eligible.push(id);
           }
+          if (isOwnerColumn && this.ownerCandidateGate) {
+            const gate = this.ownerCandidateGate;
+            eligible = eligible.filter(
+              (id) => gate(storeKey, { ...row, [field.name]: id }, targetStore.get(id))
+            );
+          }
           if (eligible.length === 0) continue;
-          const cardinality = field.relation.cardinality ?? "many";
           if (cardinality === "one" || cardinality === "many-to-one") {
             row[field.name] = randomArrayElement(eligible);
           } else {
@@ -2301,6 +2461,43 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
       }
     }
   }
+  /**
+   * Fill fields a late-registering sibling schema declares that the shared
+   * store's existing rows lack. The first registrant on a collection seeds
+   * with ITS field list; a sibling declaring extra columns (e.g. `Tag.parentId`
+   * arriving after `WikiTagRef {id,name}`) would otherwise read `undefined`
+   * where its filters expect a value. Values come from the same canonical
+   * sample policy as seeding; relation fields are then linked by the global
+   * `linkRelationFields` pass that follows registration.
+   */
+  backfillFields(storeKey, schema) {
+    const store = this.stores.get(storeKey);
+    if (!store) return;
+    const candidates = schema.fields.filter(
+      (f) => f.name !== "id" && f.name !== "createdAt" && f.name !== "updatedAt"
+    );
+    if (candidates.length === 0) return;
+    let index = 0;
+    for (const row of store.values()) {
+      index += 1;
+      const absent = candidates.filter((f) => row[f.name] === void 0);
+      if (absent.length === 0) continue;
+      const sample = sampleRow(
+        { name: schema.name, persistence: schema.persistence, fields: absent },
+        { index, strategy: "seeded", persistence: schema.persistence }
+      );
+      for (const f of absent) {
+        if (sample[f.name] !== void 0) {
+          row[f.name] = sample[f.name];
+        }
+      }
+    }
+    mockLog.debug("mock:backfill", {
+      storeKey,
+      entity: schema.name,
+      fields: candidates.map((f) => f.name)
+    });
+  }
   /**
    * Seed an entity with pre-authored instance data.
    */
@@ -2326,18 +2523,28 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
   seed(entityName, fields, count, persistence) {
     const store = this.getStore(entityName);
     const normalized = entityName.toLowerCase();
+    const storeKey = this.resolveStoreKey(entityName);
     if (this.config.debug) {
       mockLog.debug("seeding", { count, entity: entityName });
     }
-    const ownerCols = (this.config.ownerFields ?? []).map((pair) => pair.split(".")).filter(([ent]) => ent?.toLowerCase() === normalized).map(([, field]) => field).filter((field) => Boolean(field));
+    const ownerCols = this.parsedOwnerFields().filter(({ entity }) => entity.toLowerCase() === normalized).map(({ field }) => field);
     const ownerId = this.config.ownerId;
     const generated = [];
+    let fallbackStamps = 0;
     for (let i = 0; i < count; i++) {
       const item = this.generateMockItem(entityName, fields, i + 1, persistence);
       if (ownerId && ownerCols.length > 0 && i % 2 === 0) {
         for (const col of ownerCols) {
+          if (this.ownerGate && !this.ownerGate(storeKey, { ...item, [col]: ownerId })) {
+            const fallbackId = this.firstEligibleOwner(storeKey, col, item);
+            if (fallbackId === void 0) continue;
+            item[col] = fallbackId;
+            this.ownerStampedCells.push({ entity: storeKey, id: item.id, column: col });
+            fallbackStamps++;
+            continue;
+          }
           item[col] = ownerId;
-          this.ownerStampedCells.push({ entity: normalized, id: item.id, column: col });
+          this.ownerStampedCells.push({ entity: storeKey, id: item.id, column: col });
         }
       }
       store.set(item.id, item);
@@ -2346,7 +2553,23 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
         updatedAt: typeof item.updatedAt === "string" ? item.updatedAt : ""
       });
     }
-    mockLog.debug("mock:seed", () => ({ entityName, count, idsAndTimestamps: JSON.stringify(generated) }));
+    mockLog.debug("mock:seed", () => ({
+      entityName,
+      count,
+      idsAndTimestamps: JSON.stringify(generated),
+      fallbackStamps
+    }));
+  }
+  /** Parsed `config.ownerFields` pairs — every declared "Entity.field" owner
+   *  column, split once so `seed()` and `linkRelationFields()` don't each
+   *  re-parse the same strings. */
+  parsedOwnerFields() {
+    const out = [];
+    for (const pair of this.config.ownerFields ?? []) {
+      const [entity, field] = pair.split(".");
+      if (entity && field) out.push({ entity, field });
+    }
+    return out;
   }
   /**
    * Generate a single mock item. Field values come from the canonical policy in
@@ -2467,9 +2690,9 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
    * Clear all data for an entity.
    */
   clear(entityName) {
-    const normalized = entityName.toLowerCase();
-    this.stores.delete(normalized);
-    this.idCounters.delete(normalized);
+    const key = this.resolveStoreKey(entityName);
+    this.stores.delete(key);
+    this.idCounters.delete(key);
   }
   /** Clear all data + re-anchor the PRNG so the next seed loop reproduces
    *  identical rows. Hermetic-frame mode calls this between every step
@@ -2478,6 +2701,9 @@ var MockPersistenceAdapter = class _MockPersistenceAdapter {
     this.stores.clear();
     this.idCounters.clear();
     this.ownerStampedCells = [];
+    this.storeKeyByEntity.clear();
+    this.idLabelByStoreKey.clear();
+    this.storeNameById.clear();
     this.resetFakerSeed();
     mockLog.debug("mock:adapter:clearAll", { reanchored: this.config.seed });
   }

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { g as RuntimePatternValue, B as BindingContext, f as EvaluationContextExtensions, P as PatternProps, E as EffectHandlers, h as EffectContext, i as ExecutionEnvironment, j as EffectResult, S as ServiceCallContext, T as TraitDefinition } from './types-BaD_ox7e.js';
 export { k as BrowserFileMeta, l as BrowserFilePickerOptions, m as BrowserGeolocationOptions, n as BrowserGeolocationPosition, C as ConfigContext, o as Effect, a as EventListener, H as HANDLER_MANIFEST, I as IEventBus, b as RuntimeConfig, R as RuntimeEvent, d as TraitState, c as TransitionObserver, e as TransitionResult, U as Unsubscribe } from './types-BaD_ox7e.js';
-import { U as UnifiedLoaderOptions, S as SchemaLoader, I as ImportChainLike, L as LoadResult, a as LoadedSchema, b as LoadedOrbital, P as PersistenceAdapter } from './OrbitalServerRuntime-CZHHxo_A.js';
-export { E as EntitySharingMap, c as EventBus, d as EventNamespaceMap, e as InMemoryPersistence, O as OrbitalEventRequest, f as OrbitalEventResponse, g as OrbitalServerRuntimeConfig, h as PreprocessOptions, i as PreprocessResult, j as PreprocessedSchema, k as ProcessEventOptions, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, o as StateMachineManager, p as collectDeclaredConfigDefaults, q as collectDeclaredEntityDefaults, r as createInitialTraitState, s as findInitialState, t as findTransition, u as getIsolatedCollectionName, v as getNamespacedEvent, w as isBrowser, x as isElectron, y as isNamespacedEvent, z as isNode, A as normalizeEventKey, B as parseNamespacedEvent, C as preprocessSchema, D as processEvent } from './OrbitalServerRuntime-CZHHxo_A.js';
+import { U as UnifiedLoaderOptions, S as SchemaLoader, I as ImportChainLike, L as LoadResult, a as LoadedSchema, b as LoadedOrbital, P as PersistenceAdapter } from './OrbitalServerRuntime-DOJDoqXu.js';
+export { E as EntitySharingMap, c as EventBus, d as EventNamespaceMap, e as InMemoryPersistence, O as OrbitalEventRequest, f as OrbitalEventResponse, g as OrbitalServerRuntimeConfig, h as PreprocessOptions, i as PreprocessResult, j as PreprocessedSchema, k as ProcessEventOptions, R as RegisteredOrbital, l as RuntimeOrbital, m as RuntimeOrbitalSchema, n as RuntimeTrait, o as StateMachineManager, p as collectDeclaredConfigDefaults, q as collectDeclaredEntityDefaults, r as createInitialTraitState, s as findInitialState, t as findTransition, u as getIsolatedCollectionName, v as getNamespacedEvent, w as isBrowser, x as isElectron, y as isNamespacedEvent, z as isNode, A as normalizeEventKey, B as parseNamespacedEvent, C as preprocessSchema, D as processEvent } from './OrbitalServerRuntime-DOJDoqXu.js';
 import { EvaluationContext, SExpressionEvaluator } from '@almadar/evaluator';
 export { EvaluationContext, createMinimalContext } from '@almadar/evaluator';
 import { RenderBindingMarker, SExpr, RuntimeValue, TraitConfigObject, EventPayload, PatternConfig, EntityId, EntityField, EntityRow, EntityPersistence, ServiceParams, EntityAccessPolicies, PayloadField, OrbitalDefinition, OrbitalSchema } from '@almadar/core';
@@ -571,6 +571,15 @@ interface EntitySchema {
     name: string;
     /** V4 dual-carry id sibling of `name` — optional until the Phase-7 flip. */
     id?: EntityId;
+    /**
+     * Declared `persistent: <collection>` name. Entities declaring the SAME
+     * collection share ONE store — a shadow entity (`WikiTagRef [persistent:
+     * tags]`) reads the very rows its sibling (`Tag [persistent: tags]`) seeds,
+     * matching the compiled path's dedup-by-collection (orbital-shell-typescript
+     * seed.rs) and docs/Almadar_Entity.md's collection rule. Absent → the store
+     * is keyed by entity name, as before.
+     */
+    collection?: string;
     fields: NamedEntityField[];
     /** Pre-authored instance data from the schema (used instead of generated mocks) */
     seedData?: EntityRow[];
@@ -610,8 +619,14 @@ declare class MockPersistenceAdapter implements PersistenceAdapter {
     private stores;
     private schemas;
     private idCounters;
-    /** entityId -> normalized store name, so relation lookups can prefer the id sibling over `relation.entity` name-matching. */
+    /** entityId -> store key, so relation lookups can prefer the id sibling over `relation.entity` name-matching. */
     private storeNameById;
+    /** normalized entity name -> store key (the declared collection, else the name).
+     *  Entities sharing a `persistent:` collection resolve to the same store. */
+    private storeKeyByEntity;
+    /** store key -> the first registrant's entity name, used as the minted-id label
+     *  so rows in a shared collection carry one consistent id family. */
+    private idLabelByStoreKey;
     private config;
     /**
      * Every (entity, row id, column) cell `seed()` stamped with `config.ownerId`.
@@ -648,14 +663,65 @@ declare class MockPersistenceAdapter implements PersistenceAdapter {
      * No-op when there is no new id, or it matches the current one — an
      * anonymous switch (`newOwnerId === undefined`) leaves existing stamps as
      * they are rather than clearing a non-nullable owner column.
+     *
+     * Both this re-labeling AND `seed()`'s original stamping consult the
+     * `ownerGate` hook (see `setOwnerGate`) — a re-register reseeds identical
+     * rows, so gating only the restamp path leaks the moment a client
+     * connects and the deterministic reseed stamps with the updated ownerId.
      */
     restampOwner(newOwnerId: string | undefined): void;
+    /**
+     * The host's answer to "may the current viewer OWN this row?" — evaluated
+     * against the candidate row with the owner column already re-pointed,
+     * `storeKey` being the collection key the stores are keyed by. The runtime
+     * installs the registered schema's `@create` directive here (the single
+     * authority on who authors; no role heuristics), so a read-only persona
+     * never inherits authorship of drafts from the demo stamper — neither on a
+     * persona switch (`restampOwner`) nor on a deterministic reseed (`seed`).
+     * Absent hook = stamp unconditionally (pre-role-model behavior).
+     */
+    private ownerGate?;
+    setOwnerGate(gate: ((storeKey: string, candidateRow: EntityRow) => boolean) | undefined): void;
+    /**
+     * The host's answer to "may THIS identity row own this candidate row?" —
+     * evaluated per candidate rather than against the fixed default viewer, so
+     * `linkRelationFields` and the eligible-owner fallback (see
+     * `firstEligibleOwner`) can pick a policy-valid owner from the whole
+     * identity roster instead of only ever checking the current default user.
+     * Absent hook = no candidate filtering (pre-role-model behavior).
+     */
+    private ownerCandidateGate?;
+    setOwnerCandidateGate(gate: ((storeKey: string, candidateRow: EntityRow, candidateIdentityRow: EntityRow) => boolean) | undefined): void;
+    /**
+     * The store an owner column's relation field targets, resolved the same
+     * way `linkRelationFields` resolves any relation target (id sibling wins
+     * over the `entity` name string) — but keyed by STORE, mirroring that
+     * method's first-declarer-per-collection rule, so `seed()` and
+     * `restampOwner()` can find it before a `linkRelationFields` pass has run
+     * this registration. Undefined when no registered schema on `storeKey`
+     * declares `column` as a relation field.
+     */
+    private resolveOwnerColumnTargetStore;
+    /**
+     * The first identity-store row (seed order) whose persona is eligible, per
+     * the installed `ownerCandidateGate`, to own `row`'s `column` in `storeKey`
+     * — the deterministic replacement for "skip the stamp" when the CURRENT
+     * viewer fails the `@create` policy (e.g. a reader-default persona against
+     * an author|reviewer-only policy). Undefined when no gate is installed, the
+     * column isn't a resolvable relation, or no identity row is eligible — the
+     * caller keeps today's skip behavior in that case.
+     */
+    private firstEligibleOwner;
     /** Re-anchor the PRNG to the configured seed. Called before every
      *  re-seed loop so identical reseed sequences produce identical rows
      *  (timestamps + generated fields). Without this, the first
      *  reseed produces row set A, the second produces row set B, and
      *  diff observers see all rows as "changed" between frames. */
     resetFakerSeed(): void;
+    /** Resolve an entity name to its store key: the declared collection when the
+     *  entity is registered, the lowercased name otherwise (unregistered ad-hoc
+     *  creates keep working). */
+    private resolveStoreKey;
     private getStore;
     private nextId;
     /**
@@ -672,12 +738,29 @@ declare class MockPersistenceAdapter implements PersistenceAdapter {
      * of nested-tree atoms (e.g. std-thread-comments-linear with ThreadPost.
      * replies → [ThreadPost]) render empty reply cards.
      *
-     * For self-referential relations, each row gets 2–4 sibling IDs (excluding
-     * self). For cross-entity relations, IDs are picked from the target store.
-     * The runtime caps recursion at depth=2 in `populateRelations`, so
-     * grandparent-of-self cycles render two levels deep then stop.
+     * Cross-entity relations pick random IDs from the target store. A
+     * SELF-referential `one`-cardinality relation (a parent column like
+     * `Tag.parentId : Tag`) is linked deterministically instead: row 0 stays a
+     * root (`""`) and row *i* parents to row ⌊(i−1)/2⌋ — a proper forest with
+     * real roots and no cycles, so tree views and `parentId = ""` root fetches
+     * render sensibly. Self-referential `many` relations keep the 2–4 random
+     * sibling IDs (excluding self). The runtime caps recursion at depth=2 in
+     * `populateRelations`, so deep chains render two levels then stop.
+     *
+     * Entities sharing a collection are linked once per STORE, over the union
+     * of their declared relation fields (first declarer of a field name wins).
      */
     linkRelationFields(): void;
+    /**
+     * Fill fields a late-registering sibling schema declares that the shared
+     * store's existing rows lack. The first registrant on a collection seeds
+     * with ITS field list; a sibling declaring extra columns (e.g. `Tag.parentId`
+     * arriving after `WikiTagRef {id,name}`) would otherwise read `undefined`
+     * where its filters expect a value. Values come from the same canonical
+     * sample policy as seeding; relation fields are then linked by the global
+     * `linkRelationFields` pass that follows registration.
+     */
+    private backfillFields;
     /**
      * Seed an entity with pre-authored instance data.
      */
@@ -686,6 +769,10 @@ declare class MockPersistenceAdapter implements PersistenceAdapter {
      * Seed an entity with mock data.
      */
     seed(entityName: string, fields: EntityField[], count: number, persistence?: EntityPersistence): void;
+    /** Parsed `config.ownerFields` pairs — every declared "Entity.field" owner
+     *  column, split once so `seed()` and `linkRelationFields()` don't each
+     *  re-parse the same strings. */
+    private parsedOwnerFields;
     /**
      * Generate a single mock item. Field values come from the canonical policy in
      * `@almadar/core/mock`; this method owns only the id and timestamp stamping.

package/dist/index.js

@@ -1,5 +1,5 @@
-import { EffectExecutor } from './chunk-MEBKFZC4.js';
-export { EffectExecutor, EventBus, HANDLER_MANIFEST, InMemoryPersistence, MockPersistenceAdapter, StateMachineManager, TickScheduler, buildEmitsFromTraits, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, createInitialTraitState, createMockPersistence, createTestExecutor, createTickScheduler, createUnifiedLoader, findInitialState, findTransition, formatPayloadValidationError, getIsolatedCollectionName, getNamespacedEvent, isBrowser, isElectron, isNamespacedEvent, isNode, isValidDurationString, normalizeCallSiteConfigToValues, normalizeEventKey, parseDurationString, parseNamespacedEvent, preprocessSchema, processEvent, validateEventPayload, validatePayloadShapes } from './chunk-MEBKFZC4.js';
+import { EffectExecutor } from './chunk-IFSFX43J.js';
+export { EffectExecutor, EventBus, HANDLER_MANIFEST, InMemoryPersistence, MockPersistenceAdapter, StateMachineManager, TickScheduler, buildEmitsFromTraits, collectDeclaredConfigDefaults, collectDeclaredEntityDefaults, createInitialTraitState, createMockPersistence, createTestExecutor, createTickScheduler, createUnifiedLoader, findInitialState, findTransition, formatPayloadValidationError, getIsolatedCollectionName, getNamespacedEvent, isBrowser, isElectron, isNamespacedEvent, isNode, isValidDurationString, normalizeCallSiteConfigToValues, normalizeEventKey, parseDurationString, parseNamespacedEvent, preprocessSchema, processEvent, validateEventPayload, validatePayloadShapes } from './chunk-IFSFX43J.js';
 export { cronMatches, cronMinuteKey, isValidCronExpression, parseCron, parseCronField } from './chunk-OU3ITB5S.js';
 import { createContextFromBindings, applyRowAccess, checkMutationAccess, accessDeniedMessage } from './chunk-ZJ62H3ES.js';
 export { CALLSITE_PAYLOAD_PREFIX, applyRowAccess, checkMutationAccess, containsBindings, createContextFromBindings, createMinimalContext, deferEntityBindings, extractBindings, interpolateProps, interpolateValue, resolveCallSitePayloadCaptures } from './chunk-ZJ62H3ES.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/runtime",
-  "version": "6.62.0",
+  "version": "6.64.0",
   "description": "Interpreted runtime for Almadar orbital applications (OrbitalServerRuntime)",
   "type": "module",
   "main": "./dist/index.js",
@@ -57,11 +57,11 @@
     "access": "public"
   },
   "dependencies": {
-    "@almadar/core": "^10.71.0",
+    "@almadar/core": "^10.75.0",
     "@almadar/evaluator": "^2.42.0",
     "@almadar/logger": "^1.11.0",
     "@almadar/server": "^2.38.0",
-    "@almadar/std": "^16.190.0"
+    "@almadar/std": "^16.194.0"
   },
   "peerDependencies": {
     "express": "^5.0.0"