@gonvex/client 0.1.32 → 0.3.1

package/dist/index.js

@@ -1,29 +1,53 @@
-import { createQueryCacheStore, defaultQueryCacheReadTimeoutMs, } from "./query-cache.js";
-import { createSyncStore, syncHashesDigest, syncRowsHashes, } from "./sync-store.js";
+import { replicaHashesDigest, replicaRowsHashes, replicaRowKey } from "./replica-integrity.js";
 import { GonvexErrorReporter } from "./error-reporter.js";
-import { OptimisticOverlay, optimisticPatchesFromReference, } from "./optimistic.js";
-import { createMutationOutbox, } from "./outbox.js";
-export * from "./cache.js";
-export * from "./cache-coordinator.js";
-export * from "./browser-cache.js";
-export * from "./browser-cache-client.js";
-export * from "./browser-cache-shared-worker.js";
-export * from "./browser-capabilities.js";
-export * from "./persistent-cache.js";
-export * from "./query-cache.js";
-export * from "./sync-store.js";
+export { GonvexErrorReporter } from "./error-reporter.js";
+import { optimisticPatchesFromReference, } from "./optimistic.js";
+import { createReducerOutbox, } from "./outbox.js";
+import { LocalReplica, } from "./local-replica.js";
+import { runOfflineLiveQuery } from "./query-expression.js";
 export * from "./error-reporter.js";
 export * from "./optimistic.js";
 export * from "./outbox.js";
 export * from "./kv-stores.js";
 export * from "./signals.js";
-function syncCursorIsStale(subscription, cursor) {
+// Keep the mutable LocalReplica implementation private to GonvexClient. The
+// public package exposes only the read-only view plus storage/value types.
+export { MemoryLocalReplicaStorage, } from "./local-replica.js";
+export * from "./query-expression.js";
+export * from "./indexeddb-replica.js";
+export * from "./control.js";
+function asReplicaRow(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function createLocalReplicaView(replica) {
+    return Object.freeze({
+        cursor: () => replica.cursor(),
+        freshness: () => replica.freshness(),
+        version: () => replica.version(),
+        subscribe: (listener) => replica.subscribe(listener),
+        hasPendingCommand: (commandId) => replica.hasPendingCommand(commandId),
+        getWindow: (signature) => replica.getWindow(signature),
+        listWindows: () => replica.listWindows(),
+        windowRows: (signature) => replica.windowRows(signature),
+        entity: (entity, id) => replica.entity(entity, id),
+        entityBatch: (entity, ids) => replica.entityBatch(entity, ids),
+        entityRows: (entity) => replica.entityRows(entity),
+        entityCompleteness: (entity) => replica.entityCompleteness(entity),
+        liveQuery: (signature) => replica.liveQuery(signature),
+        collectionState: (signature) => replica.collectionState(signature),
+        hasLiveQuery: (signature) => replica.hasLiveQuery(signature),
+        snapshot: () => replica.snapshot(),
+    });
+}
+function replicaCursorIsStale(subscription, cursor) {
     if (subscription.retiredEpochs.has(cursor.epoch))
         return true;
     const floor = subscription.cursorFloor;
     return floor?.epoch === cursor.epoch && cursor.revision < floor.revision;
 }
-function raiseSyncCursorFloor(subscription, cursor) {
+function raiseReplicaCursorFloor(subscription, cursor) {
     if (subscription.cursorFloor && subscription.cursorFloor.epoch !== cursor.epoch) {
         subscription.retiredEpochs.add(subscription.cursorFloor.epoch);
     }
@@ -40,9 +64,9 @@ function raiseSyncCursorFloor(subscription, cursor) {
  *
  * - `server`: the runtime executed the function and returned an error.
  * - `timeout`: no response arrived within the operation timeout. For
- *   mutations/actions the write may or may not have been applied.
+ *   reducers/actions the write may or may not have been applied.
  * - `disconnected`: the socket dropped while the operation was pending.
- *   Mutations/actions fail closed unless a mutation opted into the outbox.
+ *   Reducers/actions fail closed unless a reducer opted into the outbox.
  * - `closed`: the client was explicitly closed.
  * - `auth`: authentication was rejected.
  */
@@ -59,39 +83,33 @@ export class GonvexClientError extends Error {
     }
 }
 export const DEFAULT_QUERY_TIMEOUT_MS = 20_000;
-export const DEFAULT_MUTATION_TIMEOUT_MS = 20_000;
+export const DEFAULT_REDUCER_TIMEOUT_MS = 20_000;
 export const DEFAULT_ACTION_TIMEOUT_MS = 60_000;
 // Small collections can send their row hashes immediately and repair in one
 // round trip. Everything else resumes with one 64-byte digest and only sends
 // the hash map when the server proves that something actually differs
-// (sync.needHashes) — the server verifies digest-only resumes with zero row
+// (replica.needHashes) — the server verifies digest-only resumes with zero row
 // data on the unchanged path, so a reload uploads bytes, not hash maps.
-const compactSyncIntegrityThreshold = 16;
-// Must match the runtime's per-frame sync.openMany admission limit. Keeping
-// this client-side prevents one oversized page from stranding every sync in a
+// Must match the runtime's per-frame replica.openMany admission limit. Keeping
+// this client-side prevents one oversized page from stranding every replica in a
 // batch behind a frame-level rejection.
-const maxSyncBatchOpens = 256;
+const maxReplicaBatchOpens = 256;
 // A wedged IndexedDB (observed in Chrome: open() never fires any event, so no
 // rejection ever reaches the store's error handling) must degrade the warm
 // start into a cold open — never into a permanently empty screen. Reads
 // normally settle in a few milliseconds.
-const syncStoreReadTimeoutMs = 1_000;
-// Watermarks can arrive for every tenant revision. Bound cursor-only IndexedDB
-// writes per collection while keeping the in-memory resume cursor immediate.
-const syncWatermarkPersistDelayMs = 1_000;
 export class GonvexClient {
     url;
     socket;
     handlers = new Map();
     querySubscriptions = new Map();
-    syncSubscriptions = new Map();
+    replicaSubscriptions = new Map();
     oneShotQueries = new Map();
     telemetryHandlers = new Set();
     pendingMessages = [];
-    pendingSyncOpens = new Set();
+    pendingReplicaOpens = new Set();
     pendingQuerySubscribes = new Set();
-    syncPersistence = new Map();
-    syncOpenFlushTimer;
+    replicaOpenFlushTimer;
     querySubscribeFlushTimer;
     serverCapabilities = {};
     auth = {};
@@ -105,32 +123,25 @@ export class GonvexClient {
     // or a fresh send cycle starts, so a bad token can't refresh-loop forever.
     authRetriedAfterError = false;
     authErrorHandlers = new Set();
+    managedAuthAttempt;
     telemetryEnabled = false;
-    queryCache;
-    queryCacheWaitForScope;
-    queryCacheReadTimeoutMs;
     querySubscriptionRetentionMs;
-    syncSubscriptionRetentionMs;
-    syncStore;
-    mutationOutbox;
-    overlay = new OptimisticOverlay();
-    optimisticMutationIds = new Set();
+    replicaSubscriptionRetentionMs;
+    reducerOutbox;
+    replica;
+    replicaView;
+    optimisticReducerIds = new Set();
     optimisticOutboxEntryIds = new Map();
     outboxReady;
     outboxScope = "";
     outboxScopeGeneration = 0;
     outboxEphemeralScope = randomID();
+    replicaScope = "";
+    hasAuthoritativeReplicaScope = false;
+    replicaReady = Promise.resolve();
     unsubscribeOutbox;
-    unsubscribeOverlay;
     drainingOutbox = false;
     outboxDrainTimer;
-    queryCacheDirective;
-    queryCacheGeneration = 0;
-    // Sync collections live under a visibility-only scope that survives query
-    // cache rotations (deploys); their warm reads are guarded separately.
-    syncScopeGeneration = 0;
-    queryCacheNegotiatedSocketGeneration;
-    syncIdentityGeneration = 0;
     sessionScopeHandlers = new Set();
     errorReporter;
     reconnectTimer;
@@ -139,6 +150,7 @@ export class GonvexClient {
     manuallyClosed = false;
     pendingCalls = new Map();
     connectionStateHandlers = new Set();
+    supportCommandHandlers = new Set();
     isWebSocketConnected = false;
     hasEverConnected = false;
     connectionCount = 0;
@@ -147,45 +159,72 @@ export class GonvexClient {
         this.url = url;
         this.auth = authFromOptions(options);
         this.telemetryEnabled = options.telemetry === true;
-        this.queryCache = createQueryCacheStore(options.queryCache);
-        this.queryCacheWaitForScope = options.queryCache !== undefined && options.queryCache !== false;
-        this.queryCacheReadTimeoutMs = queryCacheReadTimeout(options.queryCache === false ? undefined : options.queryCache?.readTimeoutMs);
         this.querySubscriptionRetentionMs = normalizeQuerySubscriptionRetentionMs(options.querySubscriptionRetentionMs);
-        this.syncSubscriptionRetentionMs = normalizeQuerySubscriptionRetentionMs(options.syncSubscriptionRetentionMs);
-        this.syncStore = createSyncStore(options.sync);
-        this.mutationOutbox = createMutationOutbox(options.outbox);
-        this.unsubscribeOutbox = this.mutationOutbox.subscribe(() => {
+        this.replicaSubscriptionRetentionMs = normalizeQuerySubscriptionRetentionMs(options.replicaSubscriptionRetentionMs);
+        this.reducerOutbox = createReducerOutbox(options.outbox);
+        this.replica = new LocalReplica(options.localReplica?.storage);
+        this.replicaView = createLocalReplicaView(this.replica);
+        this.unsubscribeOutbox = this.reducerOutbox.subscribe(() => {
             void this.drainOutbox();
         });
-        this.unsubscribeOverlay = this.overlay.subscribe((entity) => {
-            this.emitOptimisticEntity(entity);
-        });
-        // Defer the first restore by one microtask. Apps commonly construct the
-        // client and immediately install a cached token/identity; waiting lets the
-        // durable queue select that authenticated scope instead of briefly
-        // restoring an anonymous user's entries.
-        this.outboxReady = Promise.resolve().then(() => this.activateOutboxScope());
+        // Select the initial identity scope synchronously so subscriptions created
+        // immediately after the client cannot capture an empty placeholder scope.
+        // A same-tick setAuth supersedes this activation by generation before its
+        // snapshot can publish, so anonymous rows still cannot flash on screen.
+        const initialScope = reducerOutboxScope(this.url, this.auth, this.outboxEphemeralScope);
+        this.outboxScope = initialScope;
+        this.replicaScope = ["awaiting-server-scope", this.url, this.outboxEphemeralScope].join("\u0000");
+        this.outboxScopeGeneration += 1;
+        this.replicaReady = this.replica.activateScope(this.replicaScope, true);
+        this.outboxReady = Promise.resolve();
         this.timeouts = {
             queryTimeoutMs: options.timeouts?.queryTimeoutMs ?? DEFAULT_QUERY_TIMEOUT_MS,
-            mutationTimeoutMs: options.timeouts?.mutationTimeoutMs ?? DEFAULT_MUTATION_TIMEOUT_MS,
+            reducerTimeoutMs: options.timeouts?.reducerTimeoutMs ?? DEFAULT_REDUCER_TIMEOUT_MS,
             actionTimeoutMs: options.timeouts?.actionTimeoutMs ?? DEFAULT_ACTION_TIMEOUT_MS,
         };
         if (options.errorReporting && options.project) {
-            this.errorReporter = new GonvexErrorReporter({ endpoint: url, project: options.project, tenant: options.tenant, ...options.errorReporting });
+            this.errorReporter = new GonvexErrorReporter({
+                project: options.project,
+                tenant: options.tenant,
+                ...options.errorReporting,
+                transport: (type, payload) => this.sendNativeError(type, payload),
+            });
         }
-        this.recoverWarmSyncDirective();
     }
-    /** The client's materialized optimistic state for pending-row indicators. */
-    get optimisticOverlay() {
-        return this.overlay;
+    /** The single normalized authoritative + optimistic application data store. */
+    get localReplica() {
+        return this.replicaView;
+    }
+    replicaSignature(ref, args = {}) {
+        return querySubscriptionKey(ref, args);
+    }
+    /** Read one persisted Live Query membership without starting another transport subscription. */
+    retainedLiveQuery(signature) {
+        return this.replica.liveQuery(signature);
+    }
+    /** Resolve an ordered ID batch from one normalized entity store. */
+    replicaEntities(entity, ids) {
+        return this.replica.entityBatch(entity, ids);
     }
-    /** Number of mutations waiting for a definitive server result. */
+    /** Read rows and server-owned completeness for a persisted Replica Collection. */
+    replicaCollectionState(ref, args = {}) {
+        return this.replica.collectionState(this.replicaSignature(ref, args));
+    }
+    /** Run the generated Live Query plan over the bounded normalized cache. */
+    offlineLiveQuery(ref, args = {}) {
+        if (!ref.live?.plan) {
+            return { rows: [], completeness: "partial", supported: false, unsupportedOperator: "missingPlan" };
+        }
+        const queryArgs = isJsonRecord(args) ? args : {};
+        return runOfflineLiveQuery(this.replica.entityRows(ref.live.entity), ref.live.plan, queryArgs, this.replica.entityCompleteness(ref.live.entity));
+    }
+    /** Number of reducers waiting for a definitive server result. */
     async outboxCount() {
         await this.outboxReady;
-        return this.mutationOutbox.count(this.outboxScope);
+        return this.reducerOutbox.count(this.outboxScope);
     }
     connectionState() {
-        const inflightMutations = countPendingCalls(this.pendingCalls, "mutation");
+        const inflightReducers = countPendingCalls(this.pendingCalls, "reducer");
         const inflightActions = countPendingCalls(this.pendingCalls, "action");
         const inflightOneShotQueries = this.oneShotQueries.size;
         return {
@@ -193,8 +232,8 @@ export class GonvexClient {
             hasEverConnected: this.hasEverConnected,
             connectionCount: this.connectionCount,
             connectionRetries: this.reconnectAttempt,
-            hasInflightRequests: inflightMutations + inflightActions + inflightOneShotQueries > 0,
-            inflightMutations,
+            hasInflightRequests: inflightReducers + inflightActions + inflightOneShotQueries > 0,
+            inflightReducers,
             inflightActions,
             inflightOneShotQueries,
         };
@@ -218,6 +257,7 @@ export class GonvexClient {
         }
     }
     setAuth(auth) {
+        this.cancelManagedAuthAttempt("Authentication was replaced by a newer session.");
         this.applyAuth(auth);
         // The caller owns auth now: a token fetch still in flight from the
         // previous installation must not clobber this one when it resolves.
@@ -228,6 +268,27 @@ export class GonvexClient {
             this.sendAuth(true, { useFetcher: !hasOwn(auth, "token") });
         }
     }
+    /**
+     * Atomically install credentials and wait for the runtime to accept them.
+     * This is used by provider-owned, memory-only authentication transitions
+     * such as developer mode. Applications should normally use their auth
+     * provider rather than calling this method directly.
+     */
+    authenticate(auth) {
+        this.cancelManagedAuthAttempt("Authentication was replaced by a newer session.");
+        this.applyAuth(auth);
+        this.authFetchGeneration += 1;
+        const promise = new Promise((resolve, reject) => {
+            this.managedAuthAttempt = { ids: new Set(), resolve, reject };
+        });
+        if (this.socket?.readyState === WebSocket.OPEN) {
+            this.sendAuth(true, { useFetcher: !hasOwn(auth, "token") });
+        }
+        else {
+            this.connect();
+        }
+        return promise;
+    }
     /**
      * Subscribe to unrecoverable auth rejections: the server refused the
      * credentials and, when a token fetcher is installed, a force-refreshed
@@ -253,12 +314,21 @@ export class GonvexClient {
             // e.g. installing the hint after its token is already live — are inert.
             || (hasOwn(auth, "identity") && !sameAuthTokenIdentity(this.auth, nextAuth));
         if (scopeMayChange) {
-            this.resetQueryCacheScope();
+            this.pendingMessages.length = 0;
+            this.rejectPendingCalls((call) => new GonvexClientError(`Authentication scope changed while waiting for ${call.kind} ${call.path}`, { code: "auth", path: call.path, operation: call.kind }));
+            for (const query of this.oneShotQueries.values()) {
+                if (query.timeoutTimer)
+                    clearTimeout(query.timeoutTimer);
+                this.handlers.delete(query.id);
+                query.reject(new GonvexClientError(`Authentication scope changed while waiting for Query ${query.path}`, { code: "auth", path: query.path, operation: "query" }));
+            }
+            this.oneShotQueries.clear();
+            this.resetReplicaScopeState();
         }
         this.auth = nextAuth;
         if (scopeMayChange) {
             void this.activateOutboxScope();
-            this.recoverWarmSyncDirective();
+            this.rotateSubscriptionScopes();
         }
         if (auth.tenant !== undefined)
             this.errorReporter?.setTenant(auth.tenant);
@@ -285,8 +355,10 @@ export class GonvexClient {
             }
             this.reconnectAttempt = 0;
             this.isWebSocketConnected = true;
+            this.replica.setFreshness("verifying");
             this.hasEverConnected = true;
             this.connectionCount += 1;
+            this.errorReporter?.connectionRestored?.();
             this.sendAuth(false);
             if (isReconnect)
                 this.resubscribeQueries(generation);
@@ -297,21 +369,22 @@ export class GonvexClient {
             if (this.socket !== socket || this.manuallyClosed)
                 return;
             this.isWebSocketConnected = false;
-            this.markSyncSubscriptionsOutOfDate();
+            this.replica.setFreshness("offline");
+            this.markReplicaSubscriptionsOutOfDate();
             this.authInFlight = false;
             if (this.authWatchdogTimer) {
                 clearTimeout(this.authWatchdogTimer);
                 this.authWatchdogTimer = undefined;
             }
             // A subscription queued for the old socket is superseded by the complete
-            // resubscribe below. Queued mutations/actions are rejected below, so
+            // resubscribe below. Queued reducers/actions are rejected below, so
             // drop them too — flushing them after reconnect would fire writes whose
             // callers already saw a rejection.
             this.pendingMessages.length = 0;
-            // Mutations/actions must fail closed on transport loss: silently
+            // Reducers/actions must fail closed on transport loss: silently
             // replaying a non-idempotent write after reconnect is unsafe, and
             // leaving the promise pending hangs the caller forever.
-            this.rejectPendingCalls((call) => new GonvexClientError(`Connection lost while waiting for ${call.kind} ${call.path}. The operation may or may not have been applied.`, { code: "disconnected", path: call.path, operation: call.kind }));
+            this.rejectPendingCalls((call) => new GonvexClientError(`Connection lost while waiting for ${call.kind} ${call.path}. The operation may or may not have been applied.`, { code: "disconnected", path: call.path, operation: call.kind }), (call) => call.scope !== "control");
             this.scheduleReconnect();
             this.notifyConnectionState();
         });
@@ -327,17 +400,27 @@ export class GonvexClient {
             }
             if (message.type === "session.ready") {
                 this.serverCapabilities = message.capabilities ?? {};
+                if (!message.replica) {
+                    if (this.hasControlPlaneWork() || (!!this.auth.token && !this.auth.tenant)) {
+                        this.flushPendingMessages();
+                    }
+                    else {
+                        this.rejectMissingReplicaDirective();
+                    }
+                    return;
+                }
+                const ready = this.activateReplicaDirective(message.replica);
                 if (!this.auth.token && !this.auth.tenant) {
-                    this.installQueryCacheDirective(message.queryCache);
-                    this.queryCacheNegotiatedSocketGeneration = this.socketGeneration;
-                    this.resumeQuerySubscriptions();
+                    void ready
+                        .then(() => {
+                        this.resumeQuerySubscriptions();
+                        this.resumeReplicaSubscriptions();
+                    })
+                        .catch((error) => this.rejectReplicaDirective(error));
+                }
+                else {
+                    void ready.catch((error) => this.rejectReplicaDirective(error));
                 }
-                return;
-            }
-            if (message.type === "session.scope") {
-                this.installQueryCacheDirective(message.queryCache);
-                this.queryCacheNegotiatedSocketGeneration = this.socketGeneration;
-                this.resumeQuerySubscriptions();
                 return;
             }
             if (message.type === "auth.result" || message.type === "auth.error") {
@@ -347,10 +430,37 @@ export class GonvexClient {
                     this.authWatchdogTimer = undefined;
                 }
                 if (message.type === "auth.result") {
+                    const developerSessionToken = developerSessionTokenFromAuthResult(message.result);
+                    if (developerSessionToken) {
+                        // The activation token is single-use. Keep its rotating successor
+                        // only in process memory and use it for the next reconnect.
+                        this.auth = { ...this.auth, token: developerSessionToken, fetchToken: undefined };
+                    }
                     this.authRetriedAfterError = false;
-                    this.installQueryCacheDirective(queryCacheDirectiveFromAuthResult(message.result));
-                    this.queryCacheNegotiatedSocketGeneration = this.socketGeneration;
-                    this.resumeQuerySubscriptions();
+                    const directive = replicaDirectiveFromAuthResult(message.result);
+                    if (!directive) {
+                        if (!this.auth.tenant) {
+                            this.resumeQuerySubscriptions();
+                            this.settleManagedAuthAttempt(message.id);
+                        }
+                        else {
+                            this.settleManagedAuthAttempt(message.id, "Runtime did not provide an authoritative Local Replica visibility scope");
+                            this.rejectMissingReplicaDirective();
+                        }
+                        this.flushPendingMessages();
+                        return;
+                    }
+                    void this.activateReplicaDirective(directive)
+                        .then(() => this.activateOutboxScope())
+                        .then(() => {
+                        this.resumeQuerySubscriptions();
+                        this.resumeReplicaSubscriptions();
+                        this.settleManagedAuthAttempt(message.id);
+                    })
+                        .catch((error) => {
+                        this.settleManagedAuthAttempt(message.id, error instanceof Error ? error.message : "Runtime returned an invalid Local Replica scope");
+                        this.rejectReplicaDirective(error);
+                    });
                 }
                 else {
                     const fetcher = this.auth.fetchToken;
@@ -365,24 +475,55 @@ export class GonvexClient {
                         return;
                     }
                     this.authRetriedAfterError = false;
-                    this.resetQueryCacheScope();
+                    this.quarantineReplicaScope();
+                    this.settleManagedAuthAttempt(message.id, message.error);
                     this.notifyAuthError(message.error);
                 }
                 this.flushPendingMessages();
             }
-            if (message.type === "sync.readyMany") {
+            if (message.type === "replica.readyMany") {
                 for (const ready of message.ready) {
-                    const readyMessage = { type: "sync.ready", ...ready };
+                    const readyMessage = { type: "replica.ready", ...ready };
                     this.handlers.get(ready.id)?.(readyMessage);
                 }
                 return;
             }
-            if (message.type === "sync.watermark") {
-                if (this.serverCapabilities.syncWatermark === 1) {
-                    this.handleSyncWatermark(message.revision);
+            if (message.type === "replica.transaction") {
+                // Replica frames carry no tenant/scope field. During auth renewal we
+                // cannot safely attribute a late frame to either side of the switch.
+                if (this.authInFlight)
+                    return;
+                const scope = this.replicaScope;
+                void this.replica.applyTransaction({
+                    cursor: message.cursor,
+                    originCommandId: message.originCommandId,
+                    changes: message.changes.map((change) => ({
+                        ...change,
+                        oldValue: asReplicaRow(change.oldValue),
+                        newValue: asReplicaRow(change.newValue),
+                    })),
+                }, scope).then(() => {
+                    if (message.originCommandId && !this.replica.hasPendingCommand(message.originCommandId)) {
+                        void this.ackOptimisticReducer(message.originCommandId);
+                    }
+                }).catch(() => this.replica.setFreshness("verifying"));
+                return;
+            }
+            if (message.type === "replica.watermark") {
+                if (this.serverCapabilities.replicaWatermark === 1) {
+                    this.handleReplicaWatermark(message.revision);
                 }
                 return;
             }
+            if (message.type === "support.command") {
+                const result = message.result && typeof message.result === "object" && !Array.isArray(message.result)
+                    ? message.result
+                    : {};
+                const command = { id: message.id, kind: String(result.kind ?? ""), payload: result.payload ?? null };
+                for (const handler of this.supportCommandHandlers)
+                    handler(command);
+                return;
+            }
             if (message.type === "query.fanout") {
                 const { ids, queryType, ...shared } = message;
                 for (const id of ids) {
@@ -412,8 +553,9 @@ export class GonvexClient {
     }
     close() {
         this.manuallyClosed = true;
+        this.cancelManagedAuthAttempt("Gonvex client was closed during authentication.");
         if (isEphemeralOutboxScope(this.outboxScope)) {
-            void this.mutationOutbox.clear(this.outboxScope);
+            void this.reducerOutbox.clear(this.outboxScope);
         }
         if (this.reconnectTimer) {
             clearTimeout(this.reconnectTimer);
@@ -426,21 +568,16 @@ export class GonvexClient {
         }
         this.oneShotQueries.clear();
         this.rejectPendingCalls((call) => new GonvexClientError(`Gonvex client was closed while waiting for ${call.kind} ${call.path}`, { code: "closed", path: call.path, operation: call.kind }));
-        for (const subscription of this.syncSubscriptions.values()) {
-            this.clearSyncRetry(subscription);
+        for (const subscription of this.replicaSubscriptions.values()) {
+            this.clearReplicaRetry(subscription);
             if (subscription.unsubscribeTimer)
                 clearTimeout(subscription.unsubscribeTimer);
-            if (subscription.watermarkPersistTimer) {
-                clearTimeout(subscription.watermarkPersistTimer);
-                subscription.watermarkPersistTimer = undefined;
-                this.persistSyncSnapshot(subscription, true);
-            }
         }
-        if (this.syncOpenFlushTimer) {
-            clearTimeout(this.syncOpenFlushTimer);
-            this.syncOpenFlushTimer = undefined;
+        if (this.replicaOpenFlushTimer) {
+            clearTimeout(this.replicaOpenFlushTimer);
+            this.replicaOpenFlushTimer = undefined;
         }
-        this.pendingSyncOpens.clear();
+        this.pendingReplicaOpens.clear();
         if (this.querySubscribeFlushTimer) {
             clearTimeout(this.querySubscribeFlushTimer);
             this.querySubscribeFlushTimer = undefined;
@@ -451,39 +588,32 @@ export class GonvexClient {
             this.outboxDrainTimer = undefined;
         }
         this.unsubscribeOutbox();
-        this.unsubscribeOverlay();
-        for (const subscription of this.querySubscriptions.values()) {
-            if (subscription.cacheReadFallbackTimer)
-                clearTimeout(subscription.cacheReadFallbackTimer);
-        }
         this.handlers.clear();
         this.querySubscriptions.clear();
-        this.syncSubscriptions.clear();
+        this.replicaSubscriptions.clear();
         this.sessionScopeHandlers.clear();
         this.authErrorHandlers.clear();
         // Invalidate any token fetch still in flight so its resolve can't touch
         // the closed client's caches.
         this.authFetchGeneration += 1;
-        this.queryCacheGeneration += 1;
-        this.queryCacheDirective = undefined;
-        this.queryCache?.close();
-        this.syncStore?.close();
         this.errorReporter?.close();
         const socket = this.socket;
         this.socket = undefined;
         this.isWebSocketConnected = false;
+        this.replica.setFreshness("offline");
         this.notifyConnectionState();
         this.connectionStateHandlers.clear();
+        this.supportCommandHandlers.clear();
         if (!socket)
             return;
         socket.close();
     }
-    rejectPendingCalls(makeError) {
+    rejectPendingCalls(makeError, predicate = () => true) {
         if (this.pendingCalls.size === 0)
             return;
-        const calls = Array.from(this.pendingCalls.values());
-        this.pendingCalls.clear();
+        const calls = Array.from(this.pendingCalls.values()).filter(predicate);
         for (const call of calls) {
+            this.pendingCalls.delete(call.id);
             if (call.timeoutTimer)
                 clearTimeout(call.timeoutTimer);
             this.handlers.delete(call.id);
@@ -498,23 +628,15 @@ export class GonvexClient {
         this.sessionScopeHandlers.add(handler);
         return () => this.sessionScopeHandlers.delete(handler);
     }
-    async clearQueryCache(options = {}) {
-        if (!this.queryCache)
-            return;
-        const scope = options.allScopes ? undefined : this.queryCacheDirective?.scope;
-        if (!options.allScopes && !scope)
-            return;
-        await this.queryCache.clear(scope);
-    }
-    getQueryCacheStatus() {
-        return this.queryCache?.status() ?? {
-            enabled: false,
-            readsEnabled: false,
-            writesEnabled: false,
-            reason: "disabled-by-client",
-        };
+    onSupportCommand(handler) {
+        this.supportCommandHandlers.add(handler);
+        return () => this.supportCommandHandlers.delete(handler);
     }
-    subscribeQuery(ref, args = {}, onMessage) {
+    subscribeLiveQuery(ref, args = {}, onMessage) {
+        const isControlLiveQuery = ref.scope === "control" && ref.delivery === "live";
+        if ((!ref.live?.plan || ref.delivery !== "live") && !isControlLiveQuery) {
+            throw new GonvexClientError(`Query ${ref.path} is not a structured Live Query`, { code: "server", path: ref.path, operation: "query" });
+        }
         this.connect();
         const key = querySubscriptionKey(ref, args);
         const existing = this.querySubscriptions.get(key);
@@ -525,12 +647,11 @@ export class GonvexClient {
                 existing.unsubscribeTimer = undefined;
             }
             existing.listeners.add(onMessage);
-            this.startQueryCacheRead(existing);
             // Replay the latest result/error to this late joiner. Coalesced subscriptions
             // share a single server subscription, so the server only sends `initial` once —
             // to the first subscriber. Without this replay, components that mount after the
             // initial result arrives (e.g. a dialog opened later) would never receive data
-            // until the next server-side invalidation. Replaying here (not via the shared
+            // until the next committed change. Replaying here (not via the shared
             // handler) keeps the cached value flowing without emitting extra telemetry/traffic.
             const cached = existing.lastMessage;
             if (wasOrphaned && cached?.type === "query.error") {
@@ -556,66 +677,142 @@ export class GonvexClient {
             id: randomID(),
             key,
             path: ref.path,
-            projection: ref.optimistic?.projection,
+            live: ref.live ? { ...ref.live, resultPath: [...(ref.live.resultPath ?? [])] } : undefined,
             args,
             listeners: new Set([onMessage]),
             serverSettled: false,
+            scope: this.replicaScope,
+            executionScope: ref.scope ?? "tenant",
         };
-        if (subscription.projection) {
-            this.overlay.expectSource(subscription.key, subscription.projection.entity);
-        }
         this.querySubscriptions.set(key, subscription);
         this.handlers.set(subscription.id, (message) => {
-            const normalized = this.normalizeSubscriptionMessage(subscription, message);
-            if (!normalized)
-                return;
-            message = normalized;
+            const scope = subscription.scope ?? this.replicaScope;
+            void this.handleQueryMessage(subscription, message, scope).catch(() => this.replica.setFreshness("verifying"));
+        });
+        this.sendSubscription(subscription);
+        return () => this.unsubscribeQueryListener(key, onMessage);
+    }
+    /** Watch an authorized host-owned Control Plane Query on the persistent connection. */
+    watchControlQuery(ref, args = {}) {
+        if (ref.scope !== "control" || ref.kind !== "query" || ref.delivery !== "live") {
+            throw new GonvexClientError(`Query ${ref.path} is not a live Control Plane Query`, { code: "server", path: ref.path, operation: "query" });
+        }
+        const listeners = new Set();
+        let result;
+        let error;
+        let version = 0;
+        let snapshot = { result, version };
+        const notify = () => queueMicrotask(() => listeners.forEach((listener) => listener()));
+        const unsubscribe = this.subscribeLiveQuery(ref, args, (message) => {
             if (message.type === "query.result") {
-                if (message.cacheScope && message.cacheScope !== this.queryCacheDirective?.scope) {
-                    return;
-                }
-                subscription.serverSettled = true;
-                subscription.lastMessage = message;
-                this.recordTelemetry({
-                    type: "query",
-                    id: message.id,
-                    path: subscription.path,
-                    reason: message.reason,
-                    outcome: "ok",
-                    clientReceivedAtMs: nowMs(),
-                    serverTrace: message.trace,
-                });
-            }
-            if (message.type === "query.error") {
-                subscription.serverSettled = true;
-                subscription.lastMessage = message;
-                this.recordTelemetry({
-                    type: "query",
-                    id: message.id,
-                    path: subscription.path,
-                    outcome: "error",
-                    error: message.error,
-                    clientReceivedAtMs: nowMs(),
-                });
-            }
-            const outgoing = this.materializeQueryMessage(subscription, message);
-            for (const listener of Array.from(subscription.listeners)) {
-                listener(outgoing);
+                result = message.result;
+                error = undefined;
+                version += 1;
+                snapshot = { result, version };
+                notify();
             }
-            if (message.type === "query.result") {
-                this.acknowledgeOptimisticSource(subscription.key, message.mutationIds);
-                this.acknowledgeOptimisticQuerySnapshot(subscription, message.result);
+            else if (message.type === "query.error") {
+                error = new GonvexClientError(message.error, { code: "server", path: ref.path, operation: "query" });
+                version += 1;
+                snapshot = { result, version };
+                notify();
             }
-            if (message.type === "query.result") {
-                this.persistQueryResult(subscription, message);
+        });
+        return {
+            getSnapshot() {
+                if (error)
+                    throw error;
+                return snapshot;
+            },
+            onUpdate(listener) {
+                listeners.add(listener);
+                queueMicrotask(() => listeners.has(listener) && listener());
+                return () => {
+                    listeners.delete(listener);
+                    if (listeners.size === 0)
+                        unsubscribe();
+                };
+            },
+        };
+    }
+    async handleQueryMessage(subscription, message, scope = this.replicaScope) {
+        if (scope !== this.replicaScope || (subscription.scope !== undefined && subscription.scope !== scope))
+            return;
+        const normalized = this.normalizeSubscriptionMessage(subscription, message);
+        if (!normalized)
+            return;
+        message = normalized;
+        if (message.type === "query.result") {
+            subscription.serverSettled = true;
+            subscription.lastMessage = message;
+            this.recordTelemetry({
+                type: "query",
+                id: message.id,
+                path: subscription.path,
+                reason: message.reason,
+                outcome: "ok",
+                clientReceivedAtMs: nowMs(),
+                serverTrace: message.trace,
+            });
+        }
+        if (message.type === "query.error") {
+            subscription.serverSettled = true;
+            subscription.lastMessage = message;
+            this.recordTelemetry({
+                type: "query",
+                id: message.id,
+                path: subscription.path,
+                outcome: "error",
+                error: message.error,
+                clientReceivedAtMs: nowMs(),
+            });
+        }
+        if (message.type === "query.result" && subscription.live) {
+            // Local Replica is the source of truth for normalized Live Query
+            // reads. Publish the query callback only after its entity/membership
+            // window has been durably committed and atomically swapped.
+            try {
+                await this.materializeLiveQuery(subscription, message, scope);
             }
-            else if (message.type === "query.error") {
-                this.deleteCachedQuery(subscription);
+            catch {
+                this.replica.setFreshness("verifying");
             }
+            if (scope !== this.replicaScope || subscription.scope !== scope)
+                return;
+        }
+        if (message.type === "query.result") {
+            this.acknowledgeOptimisticSource(subscription.key, message.originCommandIds);
+            this.acknowledgeOptimisticQuerySnapshot(subscription, message.result);
+        }
+        const outgoing = this.materializeQueryMessage(subscription, message);
+        for (const listener of Array.from(subscription.listeners)) {
+            listener(outgoing);
+        }
+        // One-shot results are transient. Live rows are persisted by LocalReplica.
+    }
+    materializeLiveQuery(subscription, message, scope = this.replicaScope) {
+        const live = subscription.live;
+        if (!live)
+            return Promise.resolve();
+        const projected = rowsAtPath(message.result, live.resultPath);
+        if (!projected)
+            return Promise.resolve();
+        const rows = projected.rows.filter((row) => (row !== null && typeof row === "object" && !Array.isArray(row)));
+        return this.replica.materializeWindow({
+            signature: subscription.key,
+            kind: "live",
+            entity: live.entity,
+            key: live.key,
+            rows,
+            completeness: "complete",
+            source: message.subscriptionRevision ? "server" : "cache",
+            resultSkeleton: replaceRowsAtPath(message.result, live.resultPath, [], projected.scalar),
+            resultPath: [...live.resultPath],
+            scalar: projected.scalar,
+            windowRevision: message.windowRevision,
+            subscriptionRevision: message.subscriptionRevision,
+            scope,
         });
-        this.sendSubscription(subscription);
-        this.startQueryCacheRead(subscription);
-        return () => this.unsubscribeQueryListener(key, onMessage);
     }
     normalizeSubscriptionMessage(subscription, message) {
         if (message.type === "query.progress") {
@@ -631,7 +828,7 @@ export class GonvexClient {
             subscription.lastRevision = message.throughRevision;
             subscription.revisionSocketGeneration = this.socketGeneration;
             subscription.serverSettled = true;
-            this.acknowledgeOptimisticSource(subscription.key, message.mutationIds);
+            this.acknowledgeOptimisticSource(subscription.key, message.originCommandIds);
             // Progress advances freshness without waking React/query listeners.
             return undefined;
         }
@@ -663,10 +860,10 @@ export class GonvexClient {
                 result,
                 reason: message.reason,
                 trace: message.trace,
-                cacheScope: message.cacheScope,
-                cacheRevision: message.cacheRevision,
+                replicaScope: message.replicaScope,
+                windowRevision: message.windowRevision,
                 subscriptionRevision: message.subscriptionRevision,
-                mutationIds: message.mutationIds,
+                originCommandIds: message.originCommandIds,
             };
         }
         if (message.type === "query.pagePatch") {
@@ -689,7 +886,7 @@ export class GonvexClient {
             const metadata = isJsonRecord(message.result) ? message.result : {};
             subscription.lastRevision = message.subscriptionRevision;
             subscription.revisionSocketGeneration = this.socketGeneration;
-            return { ...message, type: "query.result", result: { ...previous.result, ...metadata, page }, mutationIds: message.mutationIds };
+            return { ...message, type: "query.result", result: { ...previous.result, ...metadata, page }, originCommandIds: message.originCommandIds };
         }
         if (message.type === "query.objectPatch") {
             if (!sameRevision(message.baseRevision, subscription.lastRevision)) {
@@ -719,7 +916,7 @@ export class GonvexClient {
             }
             subscription.lastRevision = message.subscriptionRevision;
             subscription.revisionSocketGeneration = this.socketGeneration;
-            return { ...message, type: "query.result", result, mutationIds: message.mutationIds };
+            return { ...message, type: "query.result", result, originCommandIds: message.originCommandIds };
         }
         if (message.type === "query.result" && message.subscriptionRevision) {
             if (!this.acceptRevision(subscription, message.subscriptionRevision))
@@ -740,51 +937,10 @@ export class GonvexClient {
         // could overwrite a result already accepted on the same connection.
         return subscription.revisionSocketGeneration !== this.socketGeneration;
     }
-    watchQuery(ref, args = {}) {
-        let latest;
-        let latestError;
-        const updateHandlers = new Set();
-        const unsubscribe = this.subscribeQuery(ref, args, (message) => {
-            if (message.type === "query.result") {
-                latest = message.result;
-                latestError = undefined;
-                for (const handler of updateHandlers)
-                    handler();
-            }
-            if (message.type === "query.error") {
-                latestError = new Error(message.error);
-                for (const handler of updateHandlers)
-                    handler();
-            }
-        });
-        const unsubscribeScope = this.onSessionScopeChange(() => {
-            latest = undefined;
-            latestError = undefined;
-            for (const handler of updateHandlers)
-                handler();
-        });
-        return {
-            localQueryResult() {
-                if (latestError)
-                    throw latestError;
-                return latest;
-            },
-            onUpdate(handler) {
-                updateHandlers.add(handler);
-                return () => {
-                    updateHandlers.delete(handler);
-                    if (updateHandlers.size === 0) {
-                        unsubscribe();
-                        unsubscribeScope();
-                    }
-                };
-            },
-        };
-    }
-    subscribeSync(ref, args = {}, onMessage) {
+    subscribeReplicaTransport(ref, args = {}, onMessage) {
         this.connect();
         const key = querySubscriptionKey(ref, args);
-        const existing = this.syncSubscriptions.get(key);
+        const existing = this.replicaSubscriptions.get(key);
         if (existing) {
             if (existing.unsubscribeTimer) {
                 clearTimeout(existing.unsubscribeTimer);
@@ -794,694 +950,609 @@ export class GonvexClient {
             if (existing.lastMessage) {
                 queueMicrotask(() => {
                     if (existing.listeners.has(onMessage) && existing.lastMessage) {
-                        onMessage(this.materializeSyncMessage(existing, existing.lastMessage));
+                        onMessage(this.materializeReplicaMessage(existing, existing.lastMessage));
                     }
                 });
             }
-            return () => this.unsubscribeSyncListener(key, onMessage);
+            return () => this.unsubscribeReplicaListener(key, onMessage);
         }
         const subscription = {
             id: randomID(),
             key,
             path: ref.path,
-            entity: ref.optimistic?.projection?.entity ?? ref.path,
+            entity: ref.live?.entity ?? ref.path,
             args,
             listeners: new Set([onMessage]),
-            rows: [],
-            keyField: "id",
+            scope: this.replicaScope,
             opening: false,
-            persistence: Promise.resolve(),
             retryAttempt: 0,
             isUpToDate: false,
-            hashes: {},
             forceFullIntegrity: false,
             verificationGeneration: 0,
             retiredEpochs: new Set(),
         };
-        this.overlay.expectSource(subscription.key, subscription.entity);
-        this.syncSubscriptions.set(key, subscription);
-        this.handlers.set(subscription.id, (message) => this.handleSyncMessage(subscription, message));
-        this.startSync(subscription);
-        return () => this.unsubscribeSyncListener(key, onMessage);
-    }
-    watchSync(ref, args = {}) {
-        let latest;
-        let latestError;
-        const thisClient = this;
+        this.replicaSubscriptions.set(key, subscription);
+        this.handlers.set(subscription.id, (message) => {
+            const scope = subscription.scope ?? this.replicaScope;
+            void this.handleReplicaMessage(subscription, message, scope)
+                .catch(() => this.replica.setFreshness("verifying"));
+        });
+        this.startReplica(subscription);
+        return () => this.unsubscribeReplicaListener(key, onMessage);
+    }
+    /** Subscribe to a bounded Replica Collection. */
+    subscribeReplica(ref, args = {}, onMessage) {
+        return this.subscribeReplicaTransport(ref, args, onMessage);
+    }
+    /** Watch a bounded Replica Collection through the normalized Local Replica. */
+    watchReplica(ref, args = {}) {
         const key = querySubscriptionKey(ref, args);
         const updateHandlers = new Set();
+        let latestError;
+        let snapshotVersion = -1;
+        let snapshotRows;
+        let stateVersion = -1;
+        let snapshotState;
+        let releaseTimer;
         const notify = () => {
             for (const handler of updateHandlers)
                 handler();
         };
-        const unsubscribe = this.subscribeSync(ref, args, (message) => {
-            if (message.type === "sync.snapshot") {
-                latest = message.result;
-                latestError = undefined;
+        // Keep the ReplicaSubscription as transport/reconciliation state only. The
+        // value returned by this watch always comes from normalized LocalReplica.
+        const unsubscribeTransport = this.subscribeReplicaTransport(ref, args, (message) => {
+            if (message.type === "replica.error") {
+                latestError = new Error(message.error);
                 notify();
             }
-            else if (message.type === "sync.ready") {
+            else if (message.type === "replica.syncing" || message.type === "replica.reset") {
                 latestError = undefined;
                 notify();
             }
-            else if (message.type === "sync.syncing" || message.type === "sync.reset") {
+            else if (message.type === "replica.snapshot" || message.type === "replica.ready") {
+                latestError = undefined;
+            }
+        });
+        const unsubscribeReplica = this.replica.subscribe(notify);
+        const unsubscribeScope = this.onSessionScopeChange(() => {
+            latestError = undefined;
+            notify();
+        });
+        return {
+            localReplicaResult: () => {
+                if (latestError)
+                    throw latestError;
+                if (!this.replica.hasLiveQuery(key))
+                    return undefined;
+                const version = this.replica.version();
+                if (snapshotVersion === version)
+                    return snapshotRows;
+                snapshotVersion = version;
+                snapshotRows = this.replica.liveQuery(key).rows;
+                return snapshotRows;
+            },
+            localReplicaState: () => {
+                if (latestError)
+                    throw latestError;
+                if (!this.replica.hasLiveQuery(key))
+                    return undefined;
+                const version = this.replica.version();
+                if (stateVersion === version)
+                    return snapshotState;
+                stateVersion = version;
+                snapshotState = this.replica.collectionState(key);
+                return snapshotState;
+            },
+            status: () => ({
+                isLoading: !this.replica.hasLiveQuery(key),
+                isUpToDate: this.replicaSubscriptions.get(key)?.isUpToDate === true,
+            }),
+            onUpdate(handler) {
+                if (releaseTimer) {
+                    clearTimeout(releaseTimer);
+                    releaseTimer = undefined;
+                }
+                updateHandlers.add(handler);
+                queueMicrotask(() => {
+                    if (updateHandlers.has(handler))
+                        handler();
+                });
+                return () => {
+                    updateHandlers.delete(handler);
+                    if (updateHandlers.size > 0 || releaseTimer)
+                        return;
+                    releaseTimer = setTimeout(() => {
+                        releaseTimer = undefined;
+                        if (updateHandlers.size > 0)
+                            return;
+                        unsubscribeTransport();
+                        unsubscribeReplica();
+                        unsubscribeScope();
+                    }, 0);
+                };
+            },
+        };
+    }
+    /**
+     * Watch a structured Live Query through normalized LocalReplica rows. The
+     * latest query result is retained only as the transport-shaped skeleton;
+     * its row window is always rebuilt from LocalReplica membership/entities.
+     */
+    watchLiveQuery(ref, args = {}) {
+        const key = querySubscriptionKey(ref, args);
+        const updateHandlers = new Set();
+        let transportResult;
+        let transportGeneration = 0;
+        let snapshotToken = "";
+        let snapshotResult;
+        let latestError;
+        let notifyQueued = false;
+        let releaseTimer;
+        const notify = () => {
+            if (notifyQueued)
+                return;
+            notifyQueued = true;
+            queueMicrotask(() => {
+                notifyQueued = false;
+                for (const handler of updateHandlers)
+                    handler();
+            });
+        };
+        const unsubscribeQuery = this.subscribeLiveQuery(ref, args, (message) => {
+            if (message.type === "query.result") {
+                transportResult = message.result;
+                transportGeneration += 1;
+                latestError = undefined;
+                // LocalReplica has already published its atomic window swap before
+                // this callback is emitted, so this is the single initial UI wake-up.
                 notify();
             }
-            else if (message.type === "sync.error") {
-                latestError = new Error(message.error);
+            else if (message.type === "query.error") {
+                latestError = new GonvexClientError(message.error, {
+                    code: "server", path: ref.path, operation: "query",
+                });
                 notify();
             }
         });
+        // During the initial query result, LocalReplica notifies before the
+        // transport-shaped skeleton is installed above. Suppress that empty
+        // intermediate wake-up; later transactions notify directly from the
+        // normalized store.
+        const unsubscribeReplica = this.replica.subscribe(() => {
+            if (transportResult !== undefined || this.replica.hasLiveQuery(key))
+                notify();
+        });
+        void this.replicaReady.then(() => notify());
         const unsubscribeScope = this.onSessionScopeChange(() => {
-            latest = undefined;
+            transportResult = undefined;
+            transportGeneration += 1;
+            snapshotToken = "";
+            snapshotResult = undefined;
             latestError = undefined;
             notify();
         });
         return {
-            localSyncResult() {
+            localLiveQueryResult: () => {
                 if (latestError)
                     throw latestError;
-                return latest;
-            },
-            status() {
-                return {
-                    isLoading: latest === undefined,
-                    isUpToDate: thisClient.syncSubscriptions.get(key)?.isUpToDate === true,
-                };
+                if (!ref.live)
+                    return undefined;
+                const offline = this.replica.freshness() === "offline" && ref.live.plan
+                    ? this.offlineLiveQuery(ref, args)
+                    : undefined;
+                if (!this.replica.hasLiveQuery(key) && !offline?.supported)
+                    return undefined;
+                const window = this.replica.getWindow(key);
+                const skeleton = transportResult ?? window?.resultSkeleton;
+                if (skeleton === undefined && (ref.live.resultPath?.length ?? 0) > 0)
+                    return undefined;
+                const nextToken = `${this.replica.version()}:${transportGeneration}`;
+                if (snapshotToken === nextToken)
+                    return snapshotResult;
+                const materializedRows = offline?.supported
+                    ? offline.rows
+                    : this.replica.liveQuery(key).rows;
+                const base = skeleton ?? [];
+                const projected = rowsAtPath(base, ref.live.resultPath ?? []);
+                let nextResult = !projected
+                    ? base
+                    : replaceRowsAtPath(base, ref.live.resultPath ?? [], materializedRows, projected.scalar);
+                if (offline?.supported && projected) {
+                    nextResult = replaceOfflineLiveQueryMetadata(nextResult, ref.live.resultPath ?? [], offline);
+                }
+                snapshotResult = nextResult;
+                snapshotToken = nextToken;
+                return snapshotResult;
             },
             onUpdate(handler) {
+                if (releaseTimer) {
+                    clearTimeout(releaseTimer);
+                    releaseTimer = undefined;
+                }
                 updateHandlers.add(handler);
+                queueMicrotask(() => {
+                    if (updateHandlers.has(handler))
+                        handler();
+                });
                 return () => {
                     updateHandlers.delete(handler);
-                    if (updateHandlers.size === 0) {
-                        unsubscribe();
+                    if (updateHandlers.size > 0 || releaseTimer)
+                        return;
+                    releaseTimer = setTimeout(() => {
+                        releaseTimer = undefined;
+                        if (updateHandlers.size > 0)
+                            return;
+                        unsubscribeQuery();
+                        unsubscribeReplica();
                         unsubscribeScope();
-                    }
+                    }, 0);
                 };
             },
         };
     }
-    handleSyncMessage(subscription, message) {
-        if (message.type === "sync.snapshot") {
-            // Snapshots are only valid responses to an outstanding sync.open. Live
-            // subscriptions advance through deltas; accepting an unsolicited or
-            // delayed snapshot could roll a verified collection back to old rows.
-            if (!subscription.opening)
-                return;
-            if (syncCursorIsStale(subscription, message.cursor))
-                return;
-            if (subscription.cursor
-                && message.cursor.epoch === subscription.cursor.epoch
-                && message.cursor.revision < subscription.cursor.revision)
+    async handleReplicaMessage(subscription, message, scope = this.replicaScope) {
+        if (scope !== this.replicaScope || (subscription.scope !== undefined && subscription.scope !== scope))
+            return;
+        const current = () => this.replica.getWindow(subscription.key);
+        if (message.type === "replica.snapshot") {
+            if (!subscription.opening || replicaCursorIsStale(subscription, message.cursor))
                 return;
-            this.clearSyncRetry(subscription, true);
-            subscription.verificationGeneration += 1;
-            subscription.isUpToDate = false;
+            this.clearReplicaRetry(subscription, true);
             subscription.opening = false;
-            subscription.cursor = message.cursor;
-            raiseSyncCursorFloor(subscription, message.cursor);
-            subscription.keyField = message.key;
-            subscription.mode = message.mode;
-            subscription.truncated = undefined;
-            subscription.orderBy = message.orderBy;
-            subscription.orderDirection = message.orderDirection;
-            subscription.maxRows = message.maxRows;
-            subscription.maxBytes = message.maxBytes;
-            subscription.rows = boundSyncRows(message.result, message.key, message.maxRows, message.maxBytes, message.orderBy, message.orderDirection);
-            subscription.hashes = { ...(message.hashes ?? {}) };
-            subscription.integrityDigest = undefined;
-            subscription.integrityRows = undefined;
-            subscription.integrityEpoch = undefined;
-            const snapshot = { ...message, result: subscription.rows };
+            subscription.isUpToDate = false;
+            raiseReplicaCursorFloor(subscription, message.cursor);
+            const rows = boundReplicaRows(message.result, message.key, message.maxRows, message.maxBytes, message.orderBy, message.orderDirection);
+            const window = {
+                signature: subscription.key,
+                kind: "replica",
+                entity: subscription.entity,
+                key: message.key,
+                rows: rows.filter((row) => asReplicaRow(row) !== undefined).map((row) => asReplicaRow(row)),
+                // A snapshot is still verifying until replica.ready supplies the
+                // authoritative budget/truncation result.
+                completeness: "partial",
+                source: "server",
+                cursor: message.cursor,
+                mode: message.mode,
+                orderBy: message.orderBy,
+                orderDirection: message.orderDirection,
+                maxRows: message.maxRows,
+                maxBytes: message.maxBytes,
+                hashes: message.hashes,
+                scope,
+            };
+            await this.replica.replaceWindow(window);
+            const snapshot = { ...message, result: this.replica.windowRows(subscription.key) };
             subscription.lastMessage = snapshot;
-            this.emitSyncMessage(subscription, snapshot);
-            this.persistSyncSnapshot(subscription);
+            this.emitReplicaMessage(subscription, snapshot, scope);
             return;
         }
-        if (message.type === "sync.delta") {
-            if (syncCursorIsStale(subscription, message.cursor))
+        if (message.type === "replica.delta") {
+            const prior = current();
+            if (replicaCursorIsStale(subscription, message.cursor) || (prior?.cursor && message.cursor.revision < prior.cursor.revision))
                 return;
-            if (subscription.cursor && (message.cursor.epoch !== subscription.cursor.epoch
-                || message.cursor.revision < subscription.cursor.revision
-                || (message.cursor.revision === subscription.cursor.revision
-                    && !message.digest)))
-                return;
-            this.clearSyncRetry(subscription, true);
-            subscription.verificationGeneration += 1;
+            this.clearReplicaRetry(subscription, true);
             subscription.isUpToDate = false;
-            subscription.cursor = message.cursor;
-            raiseSyncCursorFloor(subscription, message.cursor);
-            subscription.rows = applySyncDelta(subscription.rows, subscription.keyField, message.upserts ?? [], message.deleted ?? [], subscription.maxRows, subscription.maxBytes, subscription.orderBy, subscription.orderDirection);
-            for (const key of message.deleted ?? [])
-                delete subscription.hashes[key];
-            Object.assign(subscription.hashes, message.hashes ?? {});
-            subscription.integrityDigest = undefined;
-            subscription.integrityRows = undefined;
-            subscription.integrityEpoch = undefined;
-            const snapshot = {
-                type: "sync.snapshot",
-                id: subscription.id,
-                path: subscription.path,
-                result: subscription.rows,
+            raiseReplicaCursorFloor(subscription, message.cursor);
+            await this.replica.applyWindowDelta({
+                signature: subscription.key,
+                kind: "replica",
+                entity: subscription.entity,
+                key: prior?.key ?? "id",
+                upserts: (message.upserts ?? []).filter((row) => asReplicaRow(row) !== undefined).map((row) => asReplicaRow(row)),
+                deleted: message.deleted ?? [],
+                completeness: prior?.completeness ?? "partial",
+                source: "server",
                 cursor: message.cursor,
-                key: subscription.keyField,
-                mode: subscription.mode,
-                orderBy: subscription.orderBy,
-                orderDirection: subscription.orderDirection,
-                maxRows: subscription.maxRows,
-                maxBytes: subscription.maxBytes,
+                mode: prior?.mode,
+                truncated: prior?.truncated,
+                orderBy: prior?.orderBy,
+                orderDirection: prior?.orderDirection,
+                maxRows: prior?.maxRows,
+                maxBytes: prior?.maxBytes,
+                hashes: message.hashes ?? prior?.hashes,
+            });
+            const snapshot = {
+                type: "replica.snapshot", id: subscription.id, path: subscription.path,
+                result: this.replica.windowRows(subscription.key), cursor: message.cursor,
+                key: prior?.key ?? "id", mode: prior?.mode, orderBy: prior?.orderBy,
+                orderDirection: prior?.orderDirection, maxRows: prior?.maxRows, maxBytes: prior?.maxBytes,
             };
             subscription.lastMessage = snapshot;
-            this.emitSyncMessage(subscription, snapshot);
-            this.acknowledgeOptimisticSource(subscription.key, message.mutationIds);
-            this.persistSyncDelta(subscription, message.upserts ?? [], message.deleted ?? []);
+            this.acknowledgeOptimisticSource(subscription.key, message.originCommandIds);
+            this.emitReplicaMessage(subscription, snapshot, scope);
             return;
         }
-        if (message.type === "sync.reset") {
-            this.clearSyncRetry(subscription, true);
-            if (subscription.watermarkPersistTimer) {
-                clearTimeout(subscription.watermarkPersistTimer);
-                subscription.watermarkPersistTimer = undefined;
-            }
-            subscription.verificationGeneration += 1;
+        if (message.type === "replica.reset") {
+            this.clearReplicaRetry(subscription, true);
             subscription.isUpToDate = false;
-            subscription.cursor = undefined;
-            subscription.truncated = undefined;
-            subscription.rows = [];
-            subscription.persistedRows = undefined;
-            subscription.hashes = {};
-            subscription.integrityDigest = undefined;
-            subscription.integrityRows = undefined;
-            subscription.integrityEpoch = undefined;
-            subscription.forceFullIntegrity = false;
-            subscription.lastMessage = undefined;
             subscription.opening = false;
-            const directive = this.queryCacheDirective;
-            const store = this.syncStore;
-            if (directive && store) {
-                const scope = syncPersistenceScope(directive);
-                this.enqueueSyncPersistence(subscription, scope, () => store.delete(scope, subscription.path, subscription.args));
-            }
-            this.emitSyncMessage(subscription, message);
-            queueMicrotask(() => this.sendSyncOpen(subscription));
+            subscription.cursorFloor = undefined;
+            subscription.retiredEpochs.clear();
+            subscription.lastMessage = undefined;
+            await this.replica.removeWindow(subscription.key);
+            this.emitReplicaMessage(subscription, message, scope);
+            queueMicrotask(() => this.sendReplicaOpen(subscription));
             return;
         }
-        if (message.type === "sync.syncing") {
-            subscription.verificationGeneration += 1;
+        if (message.type === "replica.syncing") {
             subscription.isUpToDate = false;
-            this.emitSyncMessage(subscription, message);
+            this.emitReplicaMessage(subscription, message, scope);
             return;
         }
-        if (message.type === "sync.needHashes") {
-            subscription.verificationGeneration += 1;
+        if (message.type === "replica.needHashes") {
             subscription.isUpToDate = false;
             subscription.opening = false;
-            subscription.forceFullIntegrity = true;
-            this.emitSyncMessage(subscription, {
-                type: "sync.syncing",
-                id: subscription.id,
-                path: subscription.path,
-                reason: "integrity-reconciling",
-            });
-            queueMicrotask(() => this.sendSyncOpen(subscription));
+            this.emitReplicaMessage(subscription, { type: "replica.syncing", id: subscription.id, path: subscription.path, reason: "integrity-reconciling" }, scope);
+            queueMicrotask(() => this.sendReplicaOpen(subscription));
             return;
         }
-        if (message.type === "sync.ready") {
-            if (!subscription.cursor || (message.cursor.epoch !== subscription.cursor.epoch
-                || message.cursor.revision < subscription.cursor.revision
-                || syncCursorIsStale(subscription, message.cursor)))
+        if (message.type === "replica.ready") {
+            const window = current();
+            if (!window?.cursor || replicaCursorIsStale(subscription, message.cursor) || message.cursor.revision < window.cursor.revision)
                 return;
-            const generation = ++subscription.verificationGeneration;
-            if (!message.digest && this.serverCapabilities.syncIntegrity === 1) {
-                this.handleSyncMessage(subscription, {
-                    type: "sync.reset",
-                    id: subscription.id,
-                    path: subscription.path,
-                    reason: "integrity-missing",
-                });
+            const rows = this.replica.windowRows(subscription.key);
+            const hashes = await replicaRowsHashes(rows, window.key);
+            const digest = await replicaHashesDigest(hashes);
+            if (!message.digest || message.digest !== digest) {
+                await this.handleReplicaMessage(subscription, { type: "replica.reset", id: subscription.id, path: subscription.path, reason: "integrity-mismatch" }, scope);
                 return;
             }
-            if (!subscription.forceFullIntegrity
-                && subscription.integrityRows === subscription.rows
-                && subscription.integrityDigest
-                && subscription.integrityEpoch === subscription.cursor.epoch) {
-                if (message.digest && subscription.integrityDigest !== message.digest) {
-                    // Re-hash once before treating the server/memo disagreement as an
-                    // integrity failure. The memo may be stale even though row identity
-                    // says the collection has not changed.
-                }
-                else {
-                    this.acceptSyncReady(subscription, message, subscription.integrityDigest);
-                    return;
-                }
-            }
-            void syncRowsHashes(subscription.rows, subscription.keyField).then((hashes) => (syncHashesDigest(hashes).then((digest) => ({ digest, hashes })))).then(({ digest, hashes }) => {
-                if (generation !== subscription.verificationGeneration
-                    || this.syncSubscriptions.get(subscription.key) !== subscription)
-                    return;
-                if (message.digest && digest !== message.digest) {
-                    this.handleSyncMessage(subscription, {
-                        type: "sync.reset",
-                        id: subscription.id,
-                        path: subscription.path,
-                        reason: "integrity-mismatch",
-                    });
-                    return;
-                }
-                subscription.hashes = hashes;
-                subscription.integrityDigest = digest;
-                subscription.integrityRows = subscription.rows;
-                this.acceptSyncReady(subscription, message, digest);
-            }).catch(() => {
-                if (generation !== subscription.verificationGeneration)
-                    return;
-                this.handleSyncMessage(subscription, {
-                    type: "sync.reset",
-                    id: subscription.id,
-                    path: subscription.path,
-                    reason: "integrity-mismatch",
-                });
-            });
+            await this.acceptReplicaReady(subscription, message, scope);
             return;
         }
-        if (message.type === "sync.error") {
-            subscription.verificationGeneration += 1;
+        if (message.type === "replica.error") {
             subscription.isUpToDate = false;
             subscription.opening = false;
-            this.scheduleSyncRetry(subscription);
+            this.scheduleReplicaRetry(subscription);
         }
-        this.emitSyncMessage(subscription, message);
+        this.emitReplicaMessage(subscription, message, scope);
     }
-    acceptSyncReady(subscription, message, verifiedDigest = message.digest) {
-        this.clearSyncRetry(subscription, true);
+    async acceptReplicaReady(subscription, message, scope = this.replicaScope) {
+        this.clearReplicaRetry(subscription, true);
         subscription.isUpToDate = true;
         subscription.opening = false;
-        subscription.cursor = message.cursor;
-        raiseSyncCursorFloor(subscription, message.cursor);
-        subscription.mode = message.mode ?? subscription.mode;
-        subscription.truncated = message.truncated;
-        subscription.integrityDigest = verifiedDigest;
-        subscription.integrityRows = subscription.rows;
-        subscription.integrityEpoch = message.cursor.epoch;
-        subscription.forceFullIntegrity = false;
-        this.persistSyncSnapshot(subscription);
-        // Every emitted ready frame is self-describing: when a legacy runtime
-        // omitted the digest, the locally verified one is stamped in so consumers
-        // observe one contract regardless of the peer's protocol generation.
-        this.emitSyncMessage(subscription, message.digest === verifiedDigest ? message : { ...message, digest: verifiedDigest });
-    }
-    handleSyncWatermark(revision) {
+        raiseReplicaCursorFloor(subscription, message.cursor);
+        const window = this.replica.getWindow(subscription.key);
+        if (window) {
+            await this.replica.replaceWindow({
+                ...window, rows: this.replica.windowRows(subscription.key), source: "server", cursor: message.cursor,
+                completeness: message.truncated === true ? "partial" : "complete",
+                mode: message.mode ?? window.mode, truncated: message.truncated ?? window.truncated,
+                hashes: window.hashes,
+            });
+        }
+        this.emitReplicaMessage(subscription, message, scope);
+    }
+    handleReplicaWatermark(revision) {
         if (!Number.isSafeInteger(revision) || revision < 0)
             return;
-        for (const subscription of this.syncSubscriptions.values()) {
-            const cursor = subscription.cursor;
+        for (const subscription of this.replicaSubscriptions.values()) {
+            const cursor = this.replica.getWindow(subscription.key)?.cursor;
             if (!cursor
                 || cursor.revision >= revision
                 || !subscription.isUpToDate
                 || subscription.opening
-                || subscription.forceFullIntegrity
-                || subscription.integrityRows !== subscription.rows
-                || !subscription.integrityDigest
-                || subscription.integrityEpoch !== cursor.epoch)
+                || !this.replica.getWindow(subscription.key)?.hashes)
                 continue;
-            subscription.cursor = { ...cursor, revision };
-            raiseSyncCursorFloor(subscription, subscription.cursor);
-            this.scheduleSyncWatermarkPersistence(subscription);
+            const window = this.replica.getWindow(subscription.key);
+            if (window)
+                void this.replica.replaceWindow({ ...window, rows: this.replica.windowRows(subscription.key), cursor: { ...cursor, revision } });
         }
     }
-    scheduleSyncWatermarkPersistence(subscription) {
-        if (subscription.watermarkPersistTimer)
+    emitReplicaMessage(subscription, message, scope = this.replicaScope) {
+        if (scope !== this.replicaScope || subscription.scope !== scope)
             return;
-        subscription.watermarkPersistTimer = setTimeout(() => {
-            subscription.watermarkPersistTimer = undefined;
-            if (this.syncSubscriptions.get(subscription.key) !== subscription)
-                return;
-            this.persistSyncSnapshot(subscription, true);
-        }, syncWatermarkPersistDelayMs);
-    }
-    emitSyncMessage(subscription, message) {
-        const outgoing = this.materializeSyncMessage(subscription, message);
+        const outgoing = this.materializeReplicaMessage(subscription, message);
         for (const listener of Array.from(subscription.listeners))
             listener(outgoing);
-        if (message.type === "sync.snapshot") {
-            const settled = this.overlay.acknowledgeMatching(subscription.key, subscription.entity, message.result, message.key);
-            for (const mutationId of settled)
-                void this.ackOptimisticMutation(mutationId);
-        }
     }
-    materializeSyncMessage(subscription, message) {
-        if (message.type !== "sync.snapshot")
+    materializeReplicaMessage(subscription, message) {
+        if (message.type !== "replica.snapshot")
             return message;
         return {
             ...message,
-            result: this.overlay.apply(subscription.key, subscription.entity, message.result, message.key),
+            result: this.replica.windowRows(subscription.key),
         };
     }
     materializeQueryMessage(subscription, message) {
-        const projection = subscription.projection;
-        if (!projection || message.type !== "query.result")
-            return message;
-        const projected = rowsAtPath(message.result, projection.resultPath);
-        if (!projected)
-            return message;
-        const materialized = this.overlay.apply(subscription.key, projection.entity, projected.rows, projection.key);
-        return {
-            ...message,
-            result: replaceRowsAtPath(message.result, projection.resultPath, materialized, projected.scalar),
-        };
+        return message;
     }
     emitOptimisticEntity(entity) {
-        for (const subscription of this.syncSubscriptions.values()) {
-            if (subscription.entity !== entity)
-                continue;
-            this.overlay.expectSource(subscription.key, entity);
-            if (subscription.lastMessage?.type !== "sync.snapshot")
-                continue;
-            this.emitSyncMessage(subscription, subscription.lastMessage);
-        }
-        for (const subscription of this.querySubscriptions.values()) {
-            if (subscription.projection?.entity !== entity)
-                continue;
-            this.overlay.expectSource(subscription.key, entity);
-            if (subscription.lastMessage?.type !== "query.result")
-                continue;
-            const outgoing = this.materializeQueryMessage(subscription, subscription.lastMessage);
-            for (const listener of Array.from(subscription.listeners))
-                listener(outgoing);
-            this.acknowledgeOptimisticQuerySnapshot(subscription, subscription.lastMessage.result);
-        }
+        void entity;
     }
-    acknowledgeOptimisticSource(source, mutationIds) {
-        const settled = this.overlay.acknowledge(source, mutationIds);
-        for (const mutationId of settled)
-            void this.ackOptimisticMutation(mutationId);
+    acknowledgeOptimisticSource(source, originCommandIds) {
+        void source;
+        for (const commandId of originCommandIds ?? [])
+            this.replica.acknowledgeCommand(commandId);
     }
     acknowledgeOptimisticQuerySnapshot(subscription, result) {
-        const projection = subscription.projection;
-        if (!projection)
-            return;
-        const projected = rowsAtPath(result, projection.resultPath);
-        if (!projected)
-            return;
-        const settled = this.overlay.acknowledgeMatching(subscription.key, projection.entity, projected.rows, projection.key);
-        for (const mutationId of settled)
-            void this.ackOptimisticMutation(mutationId);
+        void subscription;
+        void result;
     }
-    markSyncSubscriptionsOutOfDate() {
-        for (const subscription of this.syncSubscriptions.values()) {
+    markReplicaSubscriptionsOutOfDate() {
+        for (const subscription of this.replicaSubscriptions.values()) {
             const wasUpToDate = subscription.isUpToDate;
             subscription.verificationGeneration += 1;
             subscription.isUpToDate = false;
             if (!wasUpToDate)
                 continue;
-            this.emitSyncMessage(subscription, {
-                type: "sync.syncing",
+            this.emitReplicaMessage(subscription, {
+                type: "replica.syncing",
                 id: subscription.id,
                 path: subscription.path,
                 reason: "disconnected",
             });
         }
     }
-    startSync(subscription) {
-        const directive = this.queryCacheDirective;
-        const store = this.syncStore;
-        if (!directive)
-            return;
-        if (!store) {
-            this.sendSyncOpen(subscription);
-            return;
+    startReplica(subscription) {
+        const cached = this.replica.getWindow(subscription.key);
+        if (cached) {
+            subscription.isUpToDate = false;
+            const message = {
+                type: "replica.snapshot", id: subscription.id, path: subscription.path,
+                result: this.replica.windowRows(subscription.key), cursor: cached.cursor ?? { epoch: "cache", revision: 0 },
+                key: cached.key, mode: cached.mode, orderBy: cached.orderBy,
+                orderDirection: cached.orderDirection, maxRows: cached.maxRows, maxBytes: cached.maxBytes,
+            };
+            subscription.lastMessage = message;
+            this.emitReplicaMessage(subscription, message, this.replicaScope);
         }
-        const scope = syncPersistenceScope(directive);
-        const generation = this.syncScopeGeneration;
-        if (subscription.cacheReadGeneration === generation)
-            return;
-        subscription.cacheReadGeneration = generation;
-        // The warm read is an optimization with a deadline. If IndexedDB never
-        // answers (a wedged Chrome origin store emits no event at all, so no
-        // rejection ever fires), open cold after the timeout: a full snapshot
-        // beats a permanently empty screen, and a late read result is discarded.
-        let cacheReadSettled = false;
-        const cacheReadTimer = setTimeout(() => {
-            if (cacheReadSettled)
-                return;
-            cacheReadSettled = true;
-            if (this.syncSubscriptions.get(subscription.key) !== subscription
-                || this.syncScopeGeneration !== generation)
-                return;
-            this.sendSyncOpen(subscription);
-        }, syncStoreReadTimeoutMs);
-        void store.load(scope, subscription.path, subscription.args).then((cached) => {
-            clearTimeout(cacheReadTimer);
-            if (cacheReadSettled)
-                return;
-            cacheReadSettled = true;
-            const currentDirective = this.queryCacheDirective;
-            if (this.syncSubscriptions.get(subscription.key) !== subscription
-                || this.syncScopeGeneration !== generation
-                || !currentDirective
-                || syncPersistenceScope(currentDirective) !== scope)
-                return;
-            if (cached) {
-                subscription.isUpToDate = false;
-                subscription.rows = cached.rows;
-                // These rows came out of the store, so the store already holds them:
-                // the ready that follows this resume must not rewrite them.
-                subscription.persistedRows = cached.rows;
-                subscription.cursor = cached.cursor;
-                raiseSyncCursorFloor(subscription, cached.cursor);
-                subscription.keyField = cached.keyField;
-                subscription.mode = cached.mode;
-                subscription.truncated = cached.truncated;
-                subscription.orderBy = cached.orderBy;
-                subscription.orderDirection = cached.orderDirection;
-                subscription.maxRows = cached.maxRows;
-                subscription.maxBytes = cached.maxBytes;
-                // Stored hash metadata is never trusted. sendSyncOpen hashes these
-                // actual materialized rows before advertising a cursor, which allows a
-                // corrupt row to be repaired by delta without a full cache reset.
-                subscription.hashes = {};
-                subscription.integrityDigest = undefined;
-                subscription.integrityRows = undefined;
-                subscription.integrityEpoch = undefined;
-                const message = {
-                    type: "sync.snapshot",
-                    id: subscription.id,
-                    path: subscription.path,
-                    result: cached.rows,
-                    cursor: cached.cursor,
-                    key: cached.keyField,
-                    mode: cached.mode,
-                    orderBy: cached.orderBy,
-                    orderDirection: cached.orderDirection,
-                    maxRows: cached.maxRows,
-                    maxBytes: cached.maxBytes,
-                };
-                subscription.lastMessage = message;
-                this.emitSyncMessage(subscription, message);
-            }
-            this.sendSyncOpen(subscription);
-        }).catch(() => {
-            clearTimeout(cacheReadTimer);
-            if (cacheReadSettled)
-                return;
-            cacheReadSettled = true;
-            this.sendSyncOpen(subscription);
-        });
+        this.sendReplicaOpen(subscription);
     }
-    sendSyncOpen(subscription) {
+    sendReplicaOpen(subscription) {
         if (subscription.listeners.size === 0 || subscription.opening)
             return;
-        if (subscription.cursor && subscription.integrityRows !== subscription.rows) {
-            subscription.opening = true;
-            const rows = subscription.rows;
-            const keyField = subscription.keyField;
-            const socketGeneration = this.socketGeneration;
-            void syncRowsHashes(rows, keyField).then((hashes) => (syncHashesDigest(hashes).then((digest) => ({ hashes, digest })))).then(({ hashes, digest }) => {
-                if (this.socketGeneration !== socketGeneration
-                    || this.syncSubscriptions.get(subscription.key) !== subscription
-                    || subscription.listeners.size === 0
-                    || subscription.rows !== rows
-                    || subscription.keyField !== keyField)
-                    return;
-                subscription.hashes = hashes;
-                subscription.integrityDigest = digest;
-                subscription.integrityRows = rows;
-                subscription.integrityEpoch = subscription.cursor?.epoch;
-                subscription.opening = false;
-                this.sendSyncOpen(subscription);
-            }).catch(() => {
-                if (this.socketGeneration !== socketGeneration
-                    || this.syncSubscriptions.get(subscription.key) !== subscription
-                    || subscription.rows !== rows)
-                    return;
-                subscription.opening = false;
-                this.handleSyncMessage(subscription, {
-                    type: "sync.reset",
-                    id: subscription.id,
-                    path: subscription.path,
-                    reason: "integrity-mismatch",
-                });
-            });
-            return;
-        }
+        const requestScope = this.replicaScope;
+        subscription.scope = requestScope;
         subscription.opening = true;
         subscription.socketGeneration = this.socketGeneration;
-        const open = this.syncOpenRequest(subscription);
-        if (this.serverCapabilities.syncBatch === 1) {
-            this.pendingSyncOpens.add(subscription);
-            if (!this.syncOpenFlushTimer) {
-                this.syncOpenFlushTimer = setTimeout(() => this.flushSyncOpens(), 0);
+        const open = this.replicaOpenRequest(subscription);
+        if (this.serverCapabilities.replicaBatch === 1) {
+            this.pendingReplicaOpens.add(subscription);
+            if (!this.replicaOpenFlushTimer) {
+                this.replicaOpenFlushTimer = setTimeout(() => this.flushReplicaOpens(), 0);
             }
             return;
         }
-        this.send({ type: "sync.open", ...open });
+        this.send({ type: "replica.open", ...open });
     }
-    syncOpenRequest(subscription) {
-        const fullIntegrity = subscription.cursor !== undefined && (subscription.forceFullIntegrity
-            || !subscription.integrityDigest
-            || subscription.rows.length <= compactSyncIntegrityThreshold);
-        const keys = fullIntegrity
-            ? subscription.rows.map((row) => syncRowKey(row, subscription.keyField)).filter(Boolean)
-            : undefined;
+    replicaOpenRequest(subscription) {
+        const window = this.replica.getWindow(subscription.key);
+        const cursor = window?.cursor;
+        const rows = this.replica.windowRows(subscription.key);
+        const fullIntegrity = cursor !== undefined;
+        const keys = fullIntegrity ? rows.map((row) => replicaRowKey(row, window?.key ?? "id")).filter(Boolean) : undefined;
         return {
             id: subscription.id,
             path: subscription.path,
             args: subscription.args,
-            cursor: subscription.cursor,
+            cursor,
             keys,
-            hashes: fullIntegrity && Object.keys(subscription.hashes).length > 0
-                ? subscription.hashes
-                : undefined,
-            digest: subscription.cursor ? subscription.integrityDigest : undefined,
+            hashes: undefined,
+            digest: undefined,
             fullIntegrity: fullIntegrity || undefined,
         };
     }
-    flushSyncOpens() {
-        this.syncOpenFlushTimer = undefined;
-        const subscriptions = Array.from(this.pendingSyncOpens);
-        this.pendingSyncOpens.clear();
+    flushReplicaOpens() {
+        this.replicaOpenFlushTimer = undefined;
+        const subscriptions = Array.from(this.pendingReplicaOpens);
+        this.pendingReplicaOpens.clear();
         const opens = subscriptions
             .filter((subscription) => (subscription.opening
             && subscription.listeners.size > 0
-            && this.syncSubscriptions.get(subscription.key) === subscription))
-            .map((subscription) => this.syncOpenRequest(subscription));
-        for (let offset = 0; offset < opens.length; offset += maxSyncBatchOpens) {
-            this.send({ type: "sync.openMany", opens: opens.slice(offset, offset + maxSyncBatchOpens) });
+            && this.replicaSubscriptions.get(subscription.key) === subscription))
+            .map((subscription) => this.replicaOpenRequest(subscription));
+        for (let offset = 0; offset < opens.length; offset += maxReplicaBatchOpens) {
+            this.send({ type: "replica.openMany", opens: opens.slice(offset, offset + maxReplicaBatchOpens) });
         }
     }
-    unsubscribeSyncListener(key, listener) {
-        const subscription = this.syncSubscriptions.get(key);
+    unsubscribeReplicaListener(key, listener) {
+        const subscription = this.replicaSubscriptions.get(key);
         if (!subscription)
             return;
         subscription.listeners.delete(listener);
         if (subscription.listeners.size > 0 || subscription.unsubscribeTimer)
             return;
         subscription.unsubscribeTimer = setTimeout(() => {
-            const latest = this.syncSubscriptions.get(key);
+            const latest = this.replicaSubscriptions.get(key);
             if (!latest || latest.listeners.size > 0)
                 return;
             latest.unsubscribeTimer = undefined;
-            this.clearSyncRetry(latest);
-            this.pendingSyncOpens.delete(latest);
-            this.syncSubscriptions.delete(key);
-            for (const mutationId of this.overlay.removeSource(key))
-                void this.ackOptimisticMutation(mutationId);
+            this.clearReplicaRetry(latest);
+            this.pendingReplicaOpens.delete(latest);
+            this.replicaSubscriptions.delete(key);
             this.handlers.delete(latest.id);
-            this.send({ type: "sync.close", id: latest.id });
-        }, this.syncSubscriptionRetentionMs);
-    }
-    persistSyncSnapshot(subscription, fromWatermark = false) {
-        if (!fromWatermark && subscription.watermarkPersistTimer) {
-            clearTimeout(subscription.watermarkPersistTimer);
-            subscription.watermarkPersistTimer = undefined;
-        }
-        const directive = this.queryCacheDirective;
-        const store = this.syncStore;
-        if (!directive || !store || !subscription.cursor)
-            return;
-        const scope = syncPersistenceScope(directive);
-        // sync.ready arrives for every collection on every reload, almost always
-        // with the rows the store already holds. Persist the advancing cursor but
-        // leave the rows alone unless they actually changed.
-        const rowsUnchanged = subscription.persistedRows === subscription.rows;
-        const value = {
-            rows: subscription.rows,
-            cursor: subscription.cursor,
-            keyField: subscription.keyField,
-            mode: subscription.mode,
-            truncated: subscription.truncated,
-            orderBy: subscription.orderBy,
-            orderDirection: subscription.orderDirection,
-            maxRows: subscription.maxRows,
-            maxBytes: subscription.maxBytes,
-            hashes: { ...subscription.hashes },
-            rowsUnchanged,
-        };
-        subscription.persistedRows = subscription.rows;
-        this.enqueueSyncPersistence(subscription, scope, () => store.replace(scope, subscription.path, subscription.args, value));
-    }
-    persistSyncDelta(subscription, upserts, deleted) {
-        if (subscription.watermarkPersistTimer) {
-            clearTimeout(subscription.watermarkPersistTimer);
-            subscription.watermarkPersistTimer = undefined;
-        }
-        const directive = this.queryCacheDirective;
-        const store = this.syncStore;
-        if (!directive || !store || !subscription.cursor)
-            return;
-        const scope = syncPersistenceScope(directive);
-        const value = {
-            cursor: subscription.cursor,
-            keyField: subscription.keyField,
-            mode: subscription.mode,
-            truncated: subscription.truncated,
-            orderBy: subscription.orderBy,
-            orderDirection: subscription.orderDirection,
-            upserts,
-            deleted,
-            maxRows: subscription.maxRows,
-            maxBytes: subscription.maxBytes,
-            hashes: { ...subscription.hashes },
-        };
-        // The delta brings the stored rows to exactly these in-memory rows, so the
-        // sync.ready that closes this batch must not rewrite the whole collection.
-        subscription.persistedRows = subscription.rows;
-        this.enqueueSyncPersistence(subscription, scope, () => store.applyDelta(scope, subscription.path, subscription.args, value));
+            this.send({ type: "replica.close", id: latest.id });
+        }, this.replicaSubscriptionRetentionMs);
     }
     activateOutboxScope() {
-        const scope = mutationOutboxScope(this.url, this.auth, this.outboxEphemeralScope);
-        if (scope === this.outboxScope)
-            return this.outboxReady ?? Promise.resolve();
+        const scope = reducerOutboxScope(this.url, this.auth, this.outboxEphemeralScope);
+        if (scope === this.outboxScope) {
+            return this.outboxReady ?? this.replicaReady;
+        }
         const previousScope = this.outboxScope;
         const generation = ++this.outboxScopeGeneration;
         // Pending state from the previous authenticated identity must disappear
         // from every live projection immediately. Its durable rows remain scoped
         // in IndexedDB and can be resumed only if that identity returns.
-        for (const mutationId of this.optimisticMutationIds)
-            this.overlay.reject(mutationId);
-        this.optimisticMutationIds.clear();
+        for (const reducerId of this.optimisticReducerIds)
+            this.replica.rejectCommand(reducerId);
+        this.optimisticReducerIds.clear();
         this.optimisticOutboxEntryIds.clear();
         if (isEphemeralOutboxScope(previousScope)) {
-            void this.mutationOutbox.clear(previousScope);
+            void this.reducerOutbox.clear(previousScope);
         }
         this.outboxScope = scope;
-        const ready = this.restoreOutbox(scope, generation);
+        const ready = this.hasAuthoritativeReplicaScope
+            ? this.restoreOutbox(scope, generation)
+            : Promise.resolve();
         this.outboxReady = ready;
         return ready;
     }
+    async activateReplicaDirective(directive) {
+        if (directive.protocolVersion !== 1
+            || !directive.visibilityScope.trim()
+            || !directive.epoch.trim()) {
+            this.quarantineReplicaScope();
+            throw new GonvexClientError("Runtime returned an invalid Local Replica scope", { code: "server", operation: "query" });
+        }
+        const scope = directive.visibilityScope.trim();
+        if (this.hasAuthoritativeReplicaScope && this.replicaScope === scope) {
+            await this.replicaReady;
+            return;
+        }
+        for (const reducerId of this.optimisticReducerIds)
+            this.replica.rejectCommand(reducerId);
+        this.optimisticReducerIds.clear();
+        this.optimisticOutboxEntryIds.clear();
+        this.resetReplicaScopeState();
+        this.replicaScope = scope;
+        this.hasAuthoritativeReplicaScope = true;
+        this.replicaReady = this.replica.activateScope(scope);
+        this.rotateSubscriptionScopes();
+        await this.replicaReady;
+        const generation = this.outboxScopeGeneration;
+        this.outboxReady = this.restoreOutbox(this.outboxScope, generation);
+        await this.outboxReady;
+    }
+    quarantineReplicaScope() {
+        // Keep the durable prior identity scope intact for an authorized future
+        // login, but make every synchronous selector fail closed immediately.
+        // The random suffix prevents a denied scope from ever restoring rows.
+        const scope = ["auth-denied", this.url, this.outboxEphemeralScope, randomID()].join("\u0000");
+        for (const reducerId of this.optimisticReducerIds)
+            this.replica.rejectCommand(reducerId);
+        this.optimisticReducerIds.clear();
+        this.optimisticOutboxEntryIds.clear();
+        this.resetReplicaScopeState();
+        this.replicaScope = scope;
+        this.hasAuthoritativeReplicaScope = false;
+        this.replicaReady = this.replica.activateScope(scope, true);
+        this.rotateSubscriptionScopes();
+    }
+    rejectMissingReplicaDirective() {
+        this.quarantineReplicaScope();
+        this.notifyAuthError("Runtime did not provide an authoritative Local Replica visibility scope");
+    }
+    rejectReplicaDirective(error) {
+        this.quarantineReplicaScope();
+        this.notifyAuthError(error instanceof Error ? error.message : "Runtime returned an invalid Local Replica scope");
+    }
     async restoreOutbox(scope, generation) {
-        const entries = await this.mutationOutbox.loadAll(scope);
+        await this.replicaReady;
+        const entries = await this.reducerOutbox.loadAll(scope);
         if (this.manuallyClosed
             || generation !== this.outboxScopeGeneration
             || scope !== this.outboxScope)
             return;
         for (const entry of entries) {
             if (entry.state === "committed" && (entry.patches?.length ?? 0) === 0) {
-                await this.mutationOutbox.ack(entry.id);
+                await this.reducerOutbox.ack(entry.id);
                 continue;
             }
             this.optimisticOutboxEntryIds.set(entry.idempotencyKey, entry.id);
-            this.addOptimisticMutation(entry.idempotencyKey, entry.patches ?? [], entry.state === "committed");
+            this.addOptimisticReducer(entry.idempotencyKey, entry.patches ?? [], entry.state === "committed");
         }
         const nextAttemptAt = Math.min(...entries
             .filter((entry) => entry.state === "pending")
@@ -1494,26 +1565,26 @@ export class GonvexClient {
         // yields until this restore promise resolves, then safely resumes it.
         void this.drainOutbox();
     }
-    addOptimisticMutation(mutationId, patches, accepted = false) {
-        if (patches.length === 0 || this.optimisticMutationIds.has(mutationId))
+    addOptimisticReducer(reducerId, patches, accepted = false) {
+        if (patches.length === 0 || this.optimisticReducerIds.has(reducerId))
             return;
-        this.optimisticMutationIds.add(mutationId);
-        this.overlay.add(mutationId, patches, { accepted });
+        this.optimisticReducerIds.add(reducerId);
+        this.replica.applyOptimistic(reducerId, patches);
     }
-    async settleOptimisticMutation(mutationId) {
-        await Promise.all(this.overlay.accept(mutationId).map((settledId) => this.ackOptimisticMutation(settledId)));
+    async settleOptimisticReducer(reducerId) {
+        await this.ackOptimisticReducer(reducerId);
     }
-    async rejectOptimisticMutation(mutationId, knownEntryId) {
-        this.optimisticMutationIds.delete(mutationId);
-        this.overlay.reject(mutationId);
-        await this.ackOptimisticMutation(mutationId, knownEntryId);
+    async rejectOptimisticReducer(reducerId, knownEntryId) {
+        this.optimisticReducerIds.delete(reducerId);
+        this.replica.rejectCommand(reducerId);
+        await this.ackOptimisticReducer(reducerId, knownEntryId);
     }
-    async ackOptimisticMutation(mutationId, knownEntryId) {
-        const entryId = knownEntryId ?? this.optimisticOutboxEntryIds.get(mutationId);
-        this.optimisticOutboxEntryIds.delete(mutationId);
-        this.optimisticMutationIds.delete(mutationId);
+    async ackOptimisticReducer(reducerId, knownEntryId) {
+        const entryId = knownEntryId ?? this.optimisticOutboxEntryIds.get(reducerId);
+        this.optimisticOutboxEntryIds.delete(reducerId);
+        this.optimisticReducerIds.delete(reducerId);
         if (entryId !== undefined)
-            await this.mutationOutbox.ack(entryId);
+            await this.reducerOutbox.ack(entryId);
     }
     async drainOutbox() {
         await this.outboxReady;
@@ -1527,30 +1598,30 @@ export class GonvexClient {
         try {
             while (!this.manuallyClosed && this.socket?.readyState === WebSocket.OPEN) {
                 const scope = this.outboxScope;
-                const entry = await this.mutationOutbox.nextReady(scope, Date.now());
+                const entry = await this.reducerOutbox.nextReady(scope, Date.now());
                 if (!entry)
                     return;
                 if (scope !== this.outboxScope)
                     return;
-                await this.mutationOutbox.markInflight(entry.id);
+                await this.reducerOutbox.markInflight(entry.id);
                 if (scope !== this.outboxScope)
                     return;
                 try {
-                    await this.call("mutation", { kind: "mutation", path: entry.path }, entry.args, this.timeouts.mutationTimeoutMs, entry.idempotencyKey, entry.idempotencyKey);
-                    await this.mutationOutbox.markCommitted(entry.id);
+                    await this.call("reducer", { kind: "reducer", path: entry.path }, entry.args, this.timeouts.reducerTimeoutMs, entry.idempotencyKey, entry.idempotencyKey);
+                    await this.reducerOutbox.markCommitted(entry.id);
                     if ((entry.patches?.length ?? 0) > 0) {
-                        await this.settleOptimisticMutation(entry.idempotencyKey);
+                        await this.settleOptimisticReducer(entry.idempotencyKey);
                     }
                     else {
-                        await this.ackOptimisticMutation(entry.idempotencyKey, entry.id);
+                        await this.ackOptimisticReducer(entry.idempotencyKey, entry.id);
                     }
                 }
                 catch (error) {
                     if (error instanceof GonvexClientError && error.code === "server") {
-                        await this.rejectOptimisticMutation(entry.idempotencyKey, entry.id);
+                        await this.rejectOptimisticReducer(entry.idempotencyKey, entry.id);
                         continue;
                     }
-                    await this.mutationOutbox.fail(entry.id, mutationErrorMessage(error));
+                    await this.reducerOutbox.fail(entry.id, reducerErrorMessage(error));
                     this.scheduleOutboxDrain(Math.min(30_000, 1_000 * (2 ** (entry.attempts + 1))));
                     return;
                 }
@@ -1573,63 +1644,70 @@ export class GonvexClient {
             void this.drainOutbox();
         }, delay);
     }
-    mutation(ref, args = {}, options = {}) {
-        const mutationId = randomID();
-        const patches = options.optimistic
-            ?? optimisticPatchesFromReference(ref.optimistic?.mutation, args);
-        if (patches.length === 0 && options.offline !== "queue") {
-            return this.call("mutation", ref, args, options.timeoutMs ?? this.timeouts.mutationTimeoutMs, mutationId);
+    reducer(ref, args = {}, options = {}) {
+        if (options.offline === "queue" && ref.offline?.mode !== "allowed") {
+            return Promise.reject(new GonvexClientError(`Reducer ${ref.path} does not allow offline queueing.`, { code: "disconnected", path: ref.path, operation: "reducer" }));
         }
-        return this.runOptimisticMutation(ref, args, options, mutationId, patches);
+        const effectiveOptions = {
+            ...options,
+            offline: options.offline ?? (ref.offline?.mode === "allowed" ? "queue" : "reject"),
+        };
+        const reducerId = randomID();
+        const patches = effectiveOptions.optimistic
+            ?? optimisticPatchesFromReference(ref.optimistic?.transaction, args);
+        if (patches.length === 0 && effectiveOptions.offline !== "queue") {
+            return this.call("reducer", ref, args, effectiveOptions.timeoutMs ?? this.timeouts.reducerTimeoutMs, reducerId);
+        }
+        return this.runOptimisticReducer(ref, args, effectiveOptions, reducerId, patches);
     }
-    async runOptimisticMutation(ref, args, options, mutationId, patches) {
+    async runOptimisticReducer(ref, args, options, reducerId, patches) {
         // The startup recovery transaction converts abandoned inflight entries to
         // pending. Finish it before inserting a brand-new direct send, otherwise
-        // recovery can mistake that live entry for a crashed mutation and race the
+        // recovery can mistake that live entry for a crashed reducer and race the
         // direct call through the background drain.
         await this.outboxReady;
         if (this.manuallyClosed) {
-            throw new GonvexClientError(`Gonvex client was closed before mutation ${ref.path} could be sent.`, { code: "closed", path: ref.path, operation: "mutation" });
+            throw new GonvexClientError(`Gonvex client was closed before reducer ${ref.path} could be sent.`, { code: "closed", path: ref.path, operation: "reducer" });
         }
         const scope = this.outboxScope;
-        const entry = await this.mutationOutbox.enqueue({
+        const entry = await this.reducerOutbox.enqueue({
             scope,
             path: ref.path,
             args,
-            idempotencyKey: mutationId,
+            idempotencyKey: reducerId,
             entityKeys: patches.map((patch) => `${patch.entity ?? patch.collection ?? ""}:${patch.rowId}`),
             patches,
             state: "inflight",
         });
         if (this.manuallyClosed) {
-            await this.mutationOutbox.ack(entry.id);
-            throw new GonvexClientError(`Gonvex client was closed before mutation ${ref.path} could be sent.`, { code: "closed", path: ref.path, operation: "mutation" });
+            await this.reducerOutbox.ack(entry.id);
+            throw new GonvexClientError(`Gonvex client was closed before reducer ${ref.path} could be sent.`, { code: "closed", path: ref.path, operation: "reducer" });
         }
         if (scope !== this.outboxScope) {
-            await this.mutationOutbox.ack(entry.id);
-            throw new GonvexClientError(`Authentication changed before mutation ${ref.path} could be sent.`, { code: "disconnected", path: ref.path, operation: "mutation" });
+            await this.reducerOutbox.ack(entry.id);
+            throw new GonvexClientError(`Authentication changed before reducer ${ref.path} could be sent.`, { code: "disconnected", path: ref.path, operation: "reducer" });
         }
-        this.optimisticOutboxEntryIds.set(mutationId, entry.id);
-        this.addOptimisticMutation(mutationId, patches);
+        this.optimisticOutboxEntryIds.set(reducerId, entry.id);
+        this.addOptimisticReducer(reducerId, patches);
         try {
             // The direct send is outbox-managed: a crash here replays the entry
             // with the same idempotency key, so the server must dedupe it.
-            const result = await this.call("mutation", ref, args, options.timeoutMs ?? this.timeouts.mutationTimeoutMs, mutationId, mutationId);
-            await this.mutationOutbox.markCommitted(entry.id);
+            const result = await this.call("reducer", ref, args, options.timeoutMs ?? this.timeouts.reducerTimeoutMs, reducerId, reducerId);
+            await this.reducerOutbox.markCommitted(entry.id);
             if (patches.length > 0) {
-                await this.settleOptimisticMutation(mutationId);
+                await this.settleOptimisticReducer(reducerId);
             }
             else {
-                await this.ackOptimisticMutation(mutationId, entry.id);
+                await this.ackOptimisticReducer(reducerId, entry.id);
             }
             return result;
         }
         catch (error) {
-            if (isQueueableMutationError(error) && options.offline === "queue") {
-                await this.mutationOutbox.fail(entry.id, mutationErrorMessage(error));
-                return { status: "queued", mutationId };
+            if (isQueueableReducerError(error) && options.offline === "queue") {
+                await this.reducerOutbox.fail(entry.id, reducerErrorMessage(error));
+                return { status: "queued", reducerId };
             }
-            await this.rejectOptimisticMutation(mutationId, entry.id);
+            await this.rejectOptimisticReducer(reducerId, entry.id);
             throw error;
         }
     }
@@ -1641,7 +1719,10 @@ export class GonvexClient {
         const id = randomID();
         const timeoutMs = options.timeoutMs ?? this.timeouts.queryTimeoutMs;
         return new Promise((resolve, reject) => {
-            const query = { id, path: ref.path, args, reject };
+            const query = {
+                id, path: ref.path, args, scope: ref.scope ?? "tenant",
+                authorization: ref.authorization, reject,
+            };
             const settle = () => {
                 if (query.timeoutTimer)
                     clearTimeout(query.timeoutTimer);
@@ -1652,7 +1733,6 @@ export class GonvexClient {
             if (timeoutMs > 0) {
                 query.timeoutTimer = setTimeout(() => {
                     settle();
-                    this.send({ type: "query.unsubscribe", id });
                     reject(new GonvexClientError(`Query ${ref.path} timed out after ${timeoutMs}ms`, { code: "timeout", path: ref.path, operation: "query" }));
                 }, timeoutMs);
             }
@@ -1669,7 +1749,6 @@ export class GonvexClient {
                         clientReceivedAtMs: nowMs(),
                         serverTrace: message.trace,
                     });
-                    this.send({ type: "query.unsubscribe", id });
                     resolve(message.result);
                 }
                 if (message.type === "query.error") {
@@ -1682,7 +1761,6 @@ export class GonvexClient {
                         error: message.error,
                         clientReceivedAtMs: nowMs(),
                     });
-                    this.send({ type: "query.unsubscribe", id });
                     reject(new GonvexClientError(message.error, { code: "server", path: ref.path, operation: "query" }));
                 }
             });
@@ -1695,7 +1773,7 @@ export class GonvexClient {
      * e.g. after a `query.error` or when a subscriber gave up waiting. No-op if
      * nothing is subscribed to this query.
      */
-    retryQuery(ref, args = {}) {
+    retryLiveQuery(ref, args = {}) {
         const subscription = this.querySubscriptions.get(querySubscriptionKey(ref, args));
         if (!subscription || subscription.listeners.size === 0)
             return;
@@ -1705,44 +1783,44 @@ export class GonvexClient {
         this.sendSubscription(subscription);
     }
     /**
-     * Flush a queue of mutations in one `mutation.callMany` frame (queue order,
+     * Flush a queue of reducers in one `reducer.callMany` frame (queue order,
      * one websocket round trip). Each entry settles independently — a failed
      * call does not reject the batch — so offline queues can apply per-row
-     * outcomes. Falls back to the standard per-mutation path when the runtime
+     * outcomes. Falls back to the standard per-reducer path when the runtime
      * lacks batching or when a call needs generated/explicit optimism or durable
-     * offline queuing, so there is never a second mutation-state implementation.
+     * offline queuing, so there is never a second reducer-state implementation.
      */
-    async mutationMany(calls, options = {}) {
+    async reducerMany(calls, options = {}) {
         if (calls.length === 0)
             return [];
         this.connect();
-        const timeoutMs = options.timeoutMs ?? this.timeouts.mutationTimeoutMs;
+        const timeoutMs = options.timeoutMs ?? this.timeouts.reducerTimeoutMs;
         const settle = (promise, path) => promise
             .then((result) => ({ status: "ok", result }))
             .catch((error) => ({
             status: "error",
             error: error instanceof GonvexClientError
                 ? error
-                : new GonvexClientError(String(error), { code: "server", path, operation: "mutation" }),
+                : new GonvexClientError(String(error), { code: "server", path, operation: "reducer" }),
         }));
-        const requiresStandardMutationPath = options.offline === "queue"
+        const requiresStandardReducerPath = options.offline === "queue"
             || options.optimistic !== undefined
-            || calls.some((call) => call.ref.optimistic?.mutation !== undefined);
-        if (this.serverCapabilities.mutationBatch !== 1 || requiresStandardMutationPath) {
+            || calls.some((call) => call.ref.optimistic?.transaction !== undefined || call.ref.scope === "control");
+        if (this.serverCapabilities.reducerBatch !== 1 || requiresStandardReducerPath) {
             const outcomes = [];
             for (const call of calls) {
-                outcomes.push(await settle(this.mutation(call.ref, call.args ?? {}, options), call.ref.path));
+                outcomes.push(await settle(this.reducer(call.ref, call.args ?? {}, options), call.ref.path));
             }
             return outcomes;
         }
         const registered = calls.map((call) => {
-            const entry = this.registerCall("mutation", call.ref, call.args ?? {}, timeoutMs);
+            const entry = this.registerCall("reducer", call.ref, call.args ?? {}, timeoutMs);
             return { ...entry, path: call.ref.path, args: call.args ?? {} };
         });
-        for (let offset = 0; offset < registered.length; offset += maxSyncBatchOpens) {
+        for (let offset = 0; offset < registered.length; offset += maxReplicaBatchOpens) {
             this.send({
-                type: "mutation.callMany",
-                calls: registered.slice(offset, offset + maxSyncBatchOpens).map((entry) => ({
+                type: "reducer.callMany",
+                calls: registered.slice(offset, offset + maxReplicaBatchOpens).map((entry) => ({
                     id: entry.id,
                     path: entry.path,
                     args: entry.args,
@@ -1755,34 +1833,48 @@ export class GonvexClient {
     }
     call(kind, ref, args, timeoutMs, id, idempotencyKey) {
         this.connect();
-        const entry = this.registerCall(kind, ref, args, timeoutMs, id);
-        if (kind === "mutation") {
-            try {
-                const w = globalThis;
-                if (w && w.__wsTapLog)
-                    w.__wsTapLog.push({ dir: "mut-args", type: "mutation.call", path: ref.path, argTenant: (args && args.tenantId) || null, authTenant: this.auth?.tenant || null, authProject: this.auth?.project || null, href: (w.location && w.location.href) || null });
-            }
-            catch (e) { }
-            this.send({
-                type: "mutation.call",
+        const callId = id ?? randomID();
+        const effectiveIdempotencyKey = ref.scope === "control"
+            ? (idempotencyKey ?? callId)
+            : idempotencyKey;
+        const entry = this.registerCall(kind, ref, args, timeoutMs, callId, effectiveIdempotencyKey);
+        if (kind === "reducer") {
+            this.sendInvocation(ref, {
+                type: "reducer.call",
                 id: entry.id,
                 path: ref.path,
                 args,
+                ...(ref.scope === "control" ? { scope: "control" } : {}),
                 trace: { clientSentAtMs: entry.clientSentAtMs },
-                ...(idempotencyKey ? { idempotencyKey } : {}),
+                ...(effectiveIdempotencyKey ? { idempotencyKey: effectiveIdempotencyKey } : {}),
             });
         }
         else {
-            this.send({ type: "action.call", id: entry.id, path: ref.path, args, trace: { clientSentAtMs: entry.clientSentAtMs } });
+            this.sendInvocation(ref, {
+                type: "action.call", id: entry.id, path: ref.path, args,
+                ...(ref.scope === "control" ? { scope: "control" } : {}),
+                ...(effectiveIdempotencyKey ? { idempotencyKey: effectiveIdempotencyKey } : {}),
+                trace: { clientSentAtMs: entry.clientSentAtMs },
+            });
         }
         this.notifyConnectionState();
         return entry.promise;
     }
-    registerCall(kind, ref, args, timeoutMs, callId = randomID()) {
+    registerCall(kind, ref, args, timeoutMs, callId = randomID(), idempotencyKey) {
         const id = callId;
         const clientSentAtMs = nowMs();
         const promise = new Promise((resolve, reject) => {
-            const pending = { id, kind, path: ref.path, reject };
+            const pending = {
+                id,
+                kind,
+                path: ref.path,
+                args,
+                scope: ref.scope ?? "tenant",
+                authorization: ref.authorization,
+                idempotencyKey,
+                socketGeneration: this.socketGeneration,
+                reject,
+            };
             const settle = () => {
                 if (pending.timeoutTimer)
                     clearTimeout(pending.timeoutTimer);
@@ -1793,17 +1885,18 @@ export class GonvexClient {
             if (timeoutMs > 0) {
                 pending.timeoutTimer = setTimeout(() => {
                     settle();
-                    reject(new GonvexClientError(`${kind === "mutation" ? "Mutation" : "Action"} ${ref.path} timed out after ${timeoutMs}ms. The operation may or may not have been applied.`, { code: "timeout", path: ref.path, operation: kind }));
+                    reject(new GonvexClientError(`${kind === "reducer" ? "Reducer" : "Action"} ${ref.path} timed out after ${timeoutMs}ms. The operation may or may not have been applied.`, { code: "timeout", path: ref.path, operation: kind }));
                 }, timeoutMs);
             }
             this.pendingCalls.set(id, pending);
             this.handlers.set(id, (message) => {
-                if (kind === "mutation" && message.type === "mutation.result") {
+                if (kind === "reducer" && message.type === "reducer.result") {
                     settle();
+                    this.replica.acknowledgeCommand(message.originCommandId, message.committedRevision);
                     this.emitTelemetryFromCall(kind, id, ref.path, "ok", clientSentAtMs, message.trace);
                     resolve(message.result);
                 }
-                if (kind === "mutation" && message.type === "mutation.error") {
+                if (kind === "reducer" && message.type === "reducer.error") {
                     settle();
                     this.emitTelemetryFromCall(kind, id, ref.path, "error", clientSentAtMs, message.trace, message.error);
                     reject(new GonvexClientError(message.error, { code: "server", path: ref.path, operation: kind }));
@@ -1838,8 +1931,6 @@ export class GonvexClient {
             if (!latest || latest.listeners.size > 0)
                 return;
             this.querySubscriptions.delete(key);
-            for (const mutationId of this.overlay.removeSource(key))
-                void this.ackOptimisticMutation(mutationId);
             this.send({ type: "query.unsubscribe", id: latest.id });
             setTimeout(() => this.handlers.delete(latest.id), 500);
         }, this.querySubscriptionRetentionMs);
@@ -1849,19 +1940,7 @@ export class GonvexClient {
             return;
         if (subscription.socketGeneration === this.socketGeneration)
             return;
-        if (this.queryCache && this.queryCacheWaitForScope) {
-            if (!this.queryCacheDirective) {
-                if (this.queryCacheNegotiatedSocketGeneration !== this.socketGeneration)
-                    return;
-            }
-            else if (subscription.cacheReadGeneration !== this.queryCacheGeneration) {
-                this.startQueryCacheRead(subscription);
-                return;
-            }
-            else if (subscription.cacheReadPromise) {
-                return;
-            }
-        }
+        subscription.scope = this.replicaScope;
         subscription.socketGeneration = this.socketGeneration;
         // Route reloads register dozens of live queries at once. Collapse the
         // burst into one batched frame per tick instead of one frame per query.
@@ -1877,7 +1956,8 @@ export class GonvexClient {
             id: subscription.id,
             path: subscription.path,
             args: subscription.args,
-            cacheRevision: subscription.cachedRevision,
+            ...(subscription.executionScope === "control" ? { scope: "control" } : {}),
+            windowRevision: undefined,
         });
     }
     flushQuerySubscribes() {
@@ -1892,10 +1972,11 @@ export class GonvexClient {
             id: subscription.id,
             path: subscription.path,
             args: subscription.args,
-            cacheRevision: subscription.cachedRevision,
+            ...(subscription.executionScope === "control" ? { scope: "control" } : {}),
+            windowRevision: undefined,
         }));
-        for (let offset = 0; offset < subscribes.length; offset += maxSyncBatchOpens) {
-            this.send({ type: "query.subscribeMany", subscribes: subscribes.slice(offset, offset + maxSyncBatchOpens) });
+        for (let offset = 0; offset < subscribes.length; offset += maxReplicaBatchOpens) {
+            this.send({ type: "query.subscribeMany", subscribes: subscribes.slice(offset, offset + maxReplicaBatchOpens) });
         }
     }
     resumeQuerySubscriptions() {
@@ -1905,25 +1986,20 @@ export class GonvexClient {
             this.sendSubscription(subscription);
         }
     }
-    enqueueSyncPersistence(subscription, scope, operation) {
-        const key = `${scope}\u0000${subscription.key}`;
-        const previous = this.syncPersistence.get(key) ?? Promise.resolve();
-        const pending = previous
-            .catch(() => undefined)
-            .then(operation)
-            .catch(() => undefined);
-        this.syncPersistence.set(key, pending);
-        subscription.persistence = pending;
-        void pending.finally(() => {
-            if (this.syncPersistence.get(key) === pending)
-                this.syncPersistence.delete(key);
-        });
+    resumeReplicaSubscriptions() {
+        for (const subscription of this.replicaSubscriptions.values()) {
+            if (subscription.listeners.size === 0)
+                continue;
+            subscription.opening = false;
+            subscription.socketGeneration = undefined;
+            this.sendReplicaOpen(subscription);
+        }
     }
-    scheduleSyncRetry(subscription) {
+    scheduleReplicaRetry(subscription) {
         if (this.manuallyClosed
             || subscription.retryTimer
             || subscription.listeners.size === 0
-            || this.syncSubscriptions.get(subscription.key) !== subscription)
+            || this.replicaSubscriptions.get(subscription.key) !== subscription)
             return;
         const delay = Math.min(250 * (2 ** subscription.retryAttempt), 5_000);
         subscription.retryAttempt += 1;
@@ -1932,13 +2008,13 @@ export class GonvexClient {
             if (this.manuallyClosed
                 || !this.isWebSocketConnected
                 || subscription.listeners.size === 0
-                || this.syncSubscriptions.get(subscription.key) !== subscription)
+                || this.replicaSubscriptions.get(subscription.key) !== subscription)
                 return;
             subscription.opening = false;
-            this.sendSyncOpen(subscription);
+            this.sendReplicaOpen(subscription);
         }, delay);
     }
-    clearSyncRetry(subscription, resetAttempt = false) {
+    clearReplicaRetry(subscription, resetAttempt = false) {
         if (subscription.retryTimer) {
             clearTimeout(subscription.retryTimer);
             subscription.retryTimer = undefined;
@@ -1949,7 +2025,6 @@ export class GonvexClient {
     requestSubscriptionSnapshot(subscription) {
         // Do not advertise the cache revision while recovering. Otherwise the
         // runtime can answer with another progress frame instead of a snapshot.
-        subscription.cachedRevision = undefined;
         subscription.serverSettled = false;
         subscription.socketGeneration = undefined;
         this.sendSubscription(subscription);
@@ -1958,7 +2033,11 @@ export class GonvexClient {
         if (query.socketGeneration === this.socketGeneration)
             return;
         query.socketGeneration = this.socketGeneration;
-        this.send({ type: "query.subscribe", id: query.id, path: query.path, args: query.args });
+        const message = { type: "query.call", id: query.id, path: query.path, args: query.args, ...(query.scope === "control" ? { scope: "control" } : {}) };
+        if (query.scope === "control" && query.authorization === "public" && this.authInFlight)
+            this.sendNow(message);
+        else
+            this.send(message);
     }
     resubscribeQueries(generation) {
         if (generation !== this.socketGeneration)
@@ -1972,15 +2051,65 @@ export class GonvexClient {
         for (const query of this.oneShotQueries.values()) {
             this.sendOneShotQuery(query);
         }
-        for (const subscription of this.syncSubscriptions.values()) {
+        for (const call of this.pendingCalls.values()) {
+            if (call.scope === "control")
+                this.sendPendingControlCall(call);
+        }
+        for (const subscription of this.replicaSubscriptions.values()) {
             if (subscription.listeners.size === 0)
                 continue;
-            this.clearSyncRetry(subscription, true);
+            this.clearReplicaRetry(subscription, true);
             subscription.opening = false;
             subscription.socketGeneration = undefined;
-            this.sendSyncOpen(subscription);
+            this.sendReplicaOpen(subscription);
         }
     }
+    sendPendingControlCall(call) {
+        if (call.socketGeneration === this.socketGeneration)
+            return;
+        call.socketGeneration = this.socketGeneration;
+        const trace = { clientSentAtMs: nowMs() };
+        if (call.kind === "reducer") {
+            const message = {
+                type: "reducer.call",
+                id: call.id,
+                path: call.path,
+                args: call.args,
+                scope: "control",
+                idempotencyKey: call.idempotencyKey ?? call.id,
+                trace,
+            };
+            if (call.authorization === "public" && this.authInFlight)
+                this.sendNow(message);
+            else
+                this.send(message);
+            return;
+        }
+        const message = {
+            type: "action.call", id: call.id, path: call.path, args: call.args,
+            scope: "control", idempotencyKey: call.idempotencyKey ?? call.id, trace,
+        };
+        if (call.authorization === "public" && this.authInFlight)
+            this.sendNow(message);
+        else
+            this.send(message);
+    }
+    sendInvocation(ref, message) {
+        if (ref.scope === "control" && ref.authorization === "public" && this.authInFlight) {
+            this.sendNow(message);
+            return;
+        }
+        this.send(message);
+    }
+    hasControlPlaneWork() {
+        for (const query of this.oneShotQueries.values())
+            if (query.scope === "control")
+                return true;
+        for (const call of this.pendingCalls.values())
+            if (call.scope === "control")
+                return true;
+        return false;
+    }
     scheduleReconnect() {
         if (this.manuallyClosed || this.reconnectTimer)
             return;
@@ -1994,204 +2123,53 @@ export class GonvexClient {
             }
         }, delay);
     }
-    installQueryCacheDirective(value) {
-        if (!validQueryCacheDirective(value)) {
-            if (this.queryCacheDirective)
-                this.resetQueryCacheScope();
-            return;
-        }
-        const previous = this.queryCacheDirective;
-        const syncScopeChanged = previous !== undefined
-            && syncPersistenceScope(previous) !== syncPersistenceScope(value);
-        if (previous?.scope === value.scope && !syncScopeChanged) {
-            this.queryCacheDirective = value;
-            return;
-        }
-        if (previous) {
-            // A deploy rotates the query-result scope (results depend on code), but
-            // sync collections are keyed by visibility and survive it: their rows,
-            // cursors, and in-flight warm reads stay valid and are verified by the
-            // server's reconcile on the next open.
-            this.resetQueryResultCacheState();
-            if (syncScopeChanged)
-                this.resetSyncCacheState();
-        }
-        this.queryCacheDirective = value;
-        const identity = authIdentityKey(this.auth);
-        if (identity)
-            void this.syncStore?.saveDirective(identity, value).catch(() => undefined);
-        for (const subscription of this.querySubscriptions.values()) {
-            this.startQueryCacheRead(subscription);
-        }
-        for (const subscription of this.syncSubscriptions.values()) {
-            this.startSync(subscription);
-        }
-    }
-    recoverWarmSyncDirective() {
-        const store = this.syncStore;
-        const identity = authIdentityKey(this.auth);
-        const generation = ++this.syncIdentityGeneration;
-        if (!store || !identity)
-            return;
-        // Same deadline as the warm collection reads: a hung IndexedDB must not
-        // stall directive recovery — the server's auth.result supplies it anyway.
-        const abandonTimer = setTimeout(() => {
-            // Only invalidate this recovery — a newer setAuth may already own the
-            // current generation.
-            if (generation === this.syncIdentityGeneration)
-                this.syncIdentityGeneration += 1;
-        }, syncStoreReadTimeoutMs);
-        void store.loadDirective(identity).then((directive) => {
-            clearTimeout(abandonTimer);
-            if (generation !== this.syncIdentityGeneration
-                || authIdentityKey(this.auth) !== identity
-                || this.queryCacheDirective
-                || !validQueryCacheDirective(directive))
-                return;
-            this.installQueryCacheDirective(directive);
-        }).catch(() => {
-            clearTimeout(abandonTimer);
-        });
-    }
-    resetQueryCacheScope() {
-        const hadScope = this.queryCacheDirective !== undefined;
-        this.queryCacheDirective = undefined;
-        this.resetQueryResultCacheState();
-        this.resetSyncCacheState();
-        if (hadScope || this.querySubscriptions.size > 0 || this.syncSubscriptions.size > 0) {
-            for (const handler of this.sessionScopeHandlers)
-                handler();
-        }
-    }
-    resetQueryResultCacheState() {
-        this.queryCacheGeneration += 1;
-        this.queryCacheNegotiatedSocketGeneration = undefined;
+    resetReplicaScopeState() {
         for (const subscription of this.querySubscriptions.values()) {
             subscription.lastMessage = undefined;
             subscription.serverSettled = false;
-            subscription.cacheReadGeneration = undefined;
-            subscription.cacheReadPromise = undefined;
-            if (subscription.cacheReadFallbackTimer)
-                clearTimeout(subscription.cacheReadFallbackTimer);
-            subscription.cacheReadFallbackTimer = undefined;
-            subscription.cachedRevision = undefined;
-        }
-    }
-    resetSyncCacheState() {
-        this.syncScopeGeneration += 1;
-        for (const subscription of this.syncSubscriptions.values()) {
-            this.clearSyncRetry(subscription, true);
-            if (subscription.watermarkPersistTimer) {
-                clearTimeout(subscription.watermarkPersistTimer);
-                subscription.watermarkPersistTimer = undefined;
-            }
+        }
+        for (const subscription of this.replicaSubscriptions.values()) {
+            this.clearReplicaRetry(subscription, true);
             subscription.isUpToDate = false;
-            subscription.rows = [];
-            subscription.persistedRows = undefined;
-            subscription.hashes = {};
-            subscription.integrityDigest = undefined;
-            subscription.integrityRows = undefined;
-            subscription.integrityEpoch = undefined;
-            subscription.forceFullIntegrity = false;
-            subscription.cursor = undefined;
             subscription.cursorFloor = undefined;
             subscription.retiredEpochs.clear();
             subscription.lastMessage = undefined;
-            subscription.cacheReadGeneration = undefined;
             subscription.opening = false;
             subscription.verificationGeneration += 1;
         }
+        for (const handler of this.sessionScopeHandlers)
+            handler();
     }
-    startQueryCacheRead(subscription) {
-        const store = this.queryCache;
-        const directive = this.queryCacheDirective;
-        if (!store || !directive || subscription.serverSettled)
-            return;
-        const generation = this.queryCacheGeneration;
-        if (subscription.cacheReadGeneration === generation)
-            return;
-        subscription.cacheReadGeneration = generation;
-        const read = store.read(directive.scope, subscription.path, subscription.args, directive.maxAgeMs).then((cached) => {
-            const current = this.querySubscriptions.get(subscription.key);
-            if (current !== subscription
-                || subscription.serverSettled
-                || subscription.listeners.size === 0
-                || this.queryCacheGeneration !== generation
-                || this.queryCacheDirective?.scope !== directive.scope) {
-                return;
-            }
-            subscription.cachedRevision = cached?.revision;
-            if (!cached)
-                return;
-            const message = {
-                type: "query.result",
-                id: subscription.id,
-                path: subscription.path,
-                result: cached.result,
-                reason: "initial",
-                cacheScope: directive.scope,
-                cacheRevision: cached.revision,
-            };
-            subscription.lastMessage = message;
-            const outgoing = this.materializeQueryMessage(subscription, message);
-            for (const listener of Array.from(subscription.listeners)) {
-                listener(outgoing);
-            }
-            this.acknowledgeOptimisticQuerySnapshot(subscription, message.result);
-        }).catch(() => {
-            // Persistent cache failures never affect the server query path.
-        }).finally(() => {
-            if (subscription.cacheReadFallbackTimer)
-                clearTimeout(subscription.cacheReadFallbackTimer);
-            subscription.cacheReadFallbackTimer = undefined;
-            if (subscription.cacheReadPromise === read)
-                subscription.cacheReadPromise = undefined;
-            if (this.querySubscriptions.get(subscription.key) === subscription
-                && subscription.listeners.size > 0
-                && this.queryCacheGeneration === generation
-                && this.queryCacheDirective?.scope === directive.scope) {
-                this.sendSubscription(subscription);
-            }
-        });
-        subscription.cacheReadPromise = read;
-        subscription.cacheReadFallbackTimer = setTimeout(() => {
-            if (subscription.cacheReadPromise !== read)
-                return;
-            subscription.cacheReadPromise = undefined;
-            subscription.cacheReadFallbackTimer = undefined;
-            this.sendSubscription(subscription);
-        }, this.queryCacheReadTimeoutMs);
-    }
-    persistQueryResult(subscription, message) {
-        const store = this.queryCache;
-        const directive = this.queryCacheDirective;
-        if (!store
-            || !directive
-            || message.cacheScope !== directive.scope
-            || !message.cacheRevision) {
-            return;
+    /**
+     * A subscription id is also the server's response routing key. Rotate it on
+     * auth scope changes so a delayed frame from the previous tenant cannot be
+     * delivered to a handler that now materializes into the new scope.
+     */
+    rotateSubscriptionScopes() {
+        for (const subscription of this.querySubscriptions.values()) {
+            this.handlers.delete(subscription.id);
+            this.pendingQuerySubscribes.delete(subscription);
+            subscription.id = randomID();
+            subscription.socketGeneration = undefined;
+            subscription.scope = this.replicaScope;
+            this.handlers.set(subscription.id, (message) => {
+                const scope = subscription.scope ?? this.replicaScope;
+                void this.handleQueryMessage(subscription, message, scope)
+                    .catch(() => this.replica.setFreshness("verifying"));
+            });
+        }
+        for (const subscription of this.replicaSubscriptions.values()) {
+            this.handlers.delete(subscription.id);
+            this.pendingReplicaOpens.delete(subscription);
+            subscription.id = randomID();
+            subscription.socketGeneration = undefined;
+            subscription.scope = this.replicaScope;
+            this.handlers.set(subscription.id, (message) => {
+                const scope = subscription.scope ?? this.replicaScope;
+                void this.handleReplicaMessage(subscription, message, scope)
+                    .catch(() => this.replica.setFreshness("verifying"));
+            });
         }
-        const generation = this.queryCacheGeneration;
-        queueMicrotask(() => {
-            if (this.queryCacheGeneration !== generation || this.queryCacheDirective?.scope !== directive.scope)
-                return;
-            void store.write({
-                scope: directive.scope,
-                path: subscription.path,
-                args: subscription.args,
-                result: message.result,
-                revision: message.cacheRevision,
-                maxAgeMs: directive.maxAgeMs,
-            }).catch(() => undefined);
-        });
-        subscription.cachedRevision = message.cacheRevision;
-    }
-    deleteCachedQuery(subscription) {
-        const store = this.queryCache;
-        const directive = this.queryCacheDirective;
-        if (!store || !directive)
-            return;
-        void store.delete(directive.scope, subscription.path, subscription.args).catch(() => undefined);
     }
     emitTelemetryFromCall(kind, id, path, outcome, clientSentAtMs, serverTrace, error) {
         const clientReceivedAtMs = nowMs();
@@ -2240,6 +2218,43 @@ export class GonvexClient {
             device: event.device ?? browserTelemetryInfo(),
         });
     }
+    /** Send a bounded native error-telemetry frame using authenticated connection attribution. */
+    reportError(type, payload) {
+        return this.sendNativeError(type, payload);
+    }
+    sendNativeError(type, payload) {
+        if (this.manuallyClosed)
+            return Promise.reject(new Error("Gonvex client is closed"));
+        this.connect();
+        const id = randomID();
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.handlers.delete(id);
+                reject(new Error("native error telemetry timed out"));
+            }, 10_000);
+            this.handlers.set(id, (message) => {
+                if (message.type !== "error.ack")
+                    return;
+                clearTimeout(timer);
+                this.handlers.delete(id);
+                if (message.error)
+                    reject(new Error(message.error));
+                else
+                    resolve();
+            });
+            if (type === "register") {
+                const registration = payload;
+                this.send({ type: "error.register", id, release: registration.release, environment: registration.environment });
+                return;
+            }
+            if (type === "heartbeat") {
+                this.send({ type: "error.heartbeat", id });
+                return;
+            }
+            const events = payload.events ?? [];
+            this.send({ type: "error.envelope", id, events });
+        });
+    }
     sendAuth(force, options = {}) {
         if (!force && !this.auth.token && !this.auth.tenant && !this.auth.project && !this.auth.fetchToken)
             return;
@@ -2254,16 +2269,36 @@ export class GonvexClient {
         this.sendAuthFrame();
     }
     sendAuthFrame() {
+        const id = randomID();
+        this.managedAuthAttempt?.ids.add(id);
         this.sendNow({
             type: "auth",
-            id: randomID(),
+            id,
             token: this.auth.token,
             project: this.auth.project,
             tenant: this.auth.tenant,
+            controlOnly: !this.auth.tenant,
             device: browserTelemetryInfo(),
-            capabilities: { syncReadyMany: 1, syncWatermark: 1, queryPagePatch: 1, queryObjectPatch: 1, queryOrderDelta: 1, queryFanout: 1, queryResultBatch: 1 },
+            capabilities: { replicaReadyMany: 1, replicaWatermark: 1, queryPagePatch: 1, queryObjectPatch: 1, queryOrderDelta: 1, queryFanout: 1, queryResultBatch: 1 },
         });
     }
+    settleManagedAuthAttempt(id, error) {
+        const attempt = this.managedAuthAttempt;
+        if (!attempt || !attempt.ids.has(id))
+            return;
+        this.managedAuthAttempt = undefined;
+        if (error)
+            attempt.reject(new GonvexClientError(error, { code: "auth" }));
+        else
+            attempt.resolve();
+    }
+    cancelManagedAuthAttempt(message) {
+        const attempt = this.managedAuthAttempt;
+        if (!attempt)
+            return;
+        this.managedAuthAttempt = undefined;
+        attempt.reject(new GonvexClientError(message, { code: "auth" }));
+    }
     // Tokens from a fetcher are typically short-lived while the socket (and any
     // disconnect gap) can span hours: replaying the token that was current at
     // setAuth time guarantees an auth.error after a long sleep. authInFlight is
@@ -2323,7 +2358,7 @@ export class GonvexClient {
             clearTimeout(this.authWatchdogTimer);
             this.authWatchdogTimer = undefined;
         }
-        this.resetQueryCacheScope();
+        this.quarantineReplicaScope();
         this.notifyAuthError(error);
         this.flushPendingMessages();
     }
@@ -2332,9 +2367,9 @@ export class GonvexClient {
             handler(error);
         }
     }
-    // A lost auth reply (e.g. the server swapped its app plugin and dropped
+    // A lost auth reply (for example, during a module-generation swap) that dropped
     // in-flight responses while the socket stayed up) used to leave
-    // authInFlight stuck true forever: every later mutation/subscription
+    // authInFlight stuck true forever: every later reducer/subscription
     // queued into pendingMessages and was never sent — no error, no timeout,
     // and the server never saw the call. Re-issue auth if no reply arrives.
     armAuthWatchdog() {
@@ -2415,8 +2450,35 @@ function replaceRowsAtPath(result, path, rows, scalar) {
     const current = result[head];
     return { ...result, [head]: replaceRowsAtPath(current ?? null, tail, rows, scalar) };
 }
+function replaceOfflineLiveQueryMetadata(result, path, offline) {
+    if (path.length === 0 || !isJsonRecord(result))
+        return result;
+    const [head, ...tail] = path;
+    if (tail.length === 0) {
+        const next = { ...result };
+        delete next.total;
+        delete next.offset;
+        delete next.limit;
+        if (offline.total !== undefined)
+            next.total = offline.total;
+        if (offline.offset !== undefined)
+            next.offset = offline.offset;
+        if (offline.limit !== undefined)
+            next.limit = offline.limit;
+        return next;
+    }
+    const current = result[head];
+    return { ...result, [head]: replaceOfflineLiveQueryMetadata(current ?? null, tail, offline) };
+}
 function querySubscriptionKey(ref, args) {
-    return `${ref.path}\u0000${stableStringify(args)}`;
+    const contract = {
+        scope: ref.scope ?? "tenant",
+        delivery: ref.delivery ?? "oneShot",
+        live: ref.live
+            ? { entity: ref.live.entity, key: ref.live.key, resultPath: [...(ref.live.resultPath ?? [])], plan: ref.live.plan ?? null }
+            : null,
+    };
+    return `${ref.path}\u0000${stableStringify(args)}\u0000${stableStringify(contract)}`;
 }
 function countPendingCalls(calls, kind) {
     let count = 0;
@@ -2426,11 +2488,11 @@ function countPendingCalls(calls, kind) {
     }
     return count;
 }
-function isQueueableMutationError(error) {
+function isQueueableReducerError(error) {
     return error instanceof GonvexClientError
         && (error.code === "disconnected" || error.code === "timeout");
 }
-function mutationErrorMessage(error) {
+function reducerErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
 function stableStringify(value) {
@@ -2462,15 +2524,15 @@ function utf8KeyCompare(left, right) {
 function sameRevision(left, right) {
     return !!right && left.epoch === right.epoch && left.sequence === right.sequence;
 }
-function boundSyncRows(rows, keyField, maxRows, maxBytes, orderBy, orderDirection) {
+function boundReplicaRows(rows, keyField, maxRows, maxBytes, orderBy, orderDirection) {
     const kept = [];
     const seen = new Set();
     let bytes = 0;
-    for (const row of sortClientSyncRows(rows, orderBy, orderDirection)) {
-        const key = syncRowKey(row, keyField);
+    for (const row of sortReplicaRows(rows, orderBy, orderDirection)) {
+        const key = replicaRowKeyValue(row, keyField);
         if (!key || seen.has(key))
             continue;
-        const size = syncJSONSize(row);
+        const size = replicaJSONSize(row);
         if (maxRows && kept.length >= maxRows)
             break;
         if (maxBytes && bytes + size > maxBytes)
@@ -2481,22 +2543,22 @@ function boundSyncRows(rows, keyField, maxRows, maxBytes, orderBy, orderDirectio
     }
     return kept;
 }
-function applySyncDelta(current, keyField, upserts, deleted, maxRows, maxBytes, orderBy, orderDirection) {
+function applyReplicaDelta(current, keyField, upserts, deleted, maxRows, maxBytes, orderBy, orderDirection) {
     const deletedSet = new Set(deleted);
-    const upsertKeys = new Set(upserts.map((row) => syncRowKey(row, keyField)).filter(Boolean));
+    const upsertKeys = new Set(upserts.map((row) => replicaRowKeyValue(row, keyField)).filter(Boolean));
     const remainder = current.filter((row) => {
-        const key = syncRowKey(row, keyField);
+        const key = replicaRowKeyValue(row, keyField);
         return key && !deletedSet.has(key) && !upsertKeys.has(key);
     });
-    return boundSyncRows([...upserts, ...remainder], keyField, maxRows, maxBytes, orderBy, orderDirection);
+    return boundReplicaRows([...upserts, ...remainder], keyField, maxRows, maxBytes, orderBy, orderDirection);
 }
-function sortClientSyncRows(rows, orderBy, orderDirection) {
+function sortReplicaRows(rows, orderBy, orderDirection) {
     if (!orderBy)
         return rows;
     const direction = orderDirection === "asc" ? 1 : -1;
     return [...rows].sort((left, right) => {
-        const leftValue = syncOrderValue(left, orderBy);
-        const rightValue = syncOrderValue(right, orderBy);
+        const leftValue = replicaOrderValue(left, orderBy);
+        const rightValue = replicaOrderValue(right, orderBy);
         if (leftValue === rightValue)
             return 0;
         if (leftValue === null)
@@ -2506,19 +2568,19 @@ function sortClientSyncRows(rows, orderBy, orderDirection) {
         return leftValue < rightValue ? -direction : direction;
     });
 }
-function syncOrderValue(value, orderBy) {
+function replicaOrderValue(value, orderBy) {
     if (!value || Array.isArray(value) || typeof value !== "object")
         return null;
     const candidate = value[orderBy];
     return typeof candidate === "string" || typeof candidate === "number" ? candidate : null;
 }
-function syncRowKey(value, keyField) {
+function replicaRowKeyValue(value, keyField) {
     if (!value || Array.isArray(value) || typeof value !== "object")
         return "";
     const key = value[keyField];
     return key === null || key === undefined ? "" : String(key);
 }
-function syncJSONSize(value) {
+function replicaJSONSize(value) {
     return new TextEncoder().encode(stableStringify(value)).byteLength;
 }
 function applyKeyedPatch(previous, patch) {
@@ -2586,11 +2648,6 @@ function queryPatchRowKey(value) {
     const candidate = value._id ?? value.id;
     return typeof candidate === "string" || typeof candidate === "number" ? String(candidate) : "";
 }
-export class ConvexReactClient extends GonvexClient {
-    constructor(url, options = {}) {
-        super(toWebSocketURL(url, options.project), options);
-    }
-}
 function authFromOptions(options) {
     return {
         project: options.project,
@@ -2611,10 +2668,13 @@ function normalizeQuerySubscriptionRetentionMs(value) {
 function authIdentityKey(auth) {
     if (!auth.tenant)
         return "";
-    if (auth.token)
-        return authIdentityKeyFromToken(auth);
+    if (auth.token) {
+        const tokenIdentity = authIdentityKeyFromToken(auth);
+        if (tokenIdentity)
+            return tokenIdentity;
+    }
     // Token-free fallback: an explicit identity hint carries the same claims a
-    // token would supply, so both paths derive the same key for the same user.
+    // token would supply, so both paths derive the same key for the same Account.
     const hint = auth.identity;
     if (hint && typeof hint.sub === "string" && hint.sub.trim()) {
         return [auth.project ?? "", auth.tenant, hint.iss ?? "", hint.sub].join("\u0000");
@@ -2649,70 +2709,53 @@ function sameAuthTokenIdentity(left, right) {
     const rightIdentity = authIdentityKey(right);
     return leftIdentity !== "" && leftIdentity === rightIdentity;
 }
-function mutationOutboxScope(url, auth, ephemeralScope) {
+function reducerOutboxScope(url, auth, ephemeralScope) {
     const identity = authIdentityKey(auth);
     if (identity)
         return ["identity", url, identity].join("\u0000");
     if (auth.token || auth.identity || auth.fetchToken) {
         // Opaque tokens (or credentials installed before tenant selection) do not
-        // expose a stable user key. A per-client scope preserves current-session
-        // queue semantics without ever restoring those rows under another user.
+        // expose a stable Account key. A per-client scope preserves current-session
+        // queue semantics without ever restoring those rows under another Account.
         return ["ephemeral-auth", url, ephemeralScope].join("\u0000");
     }
     // Anonymous/dev-auth clients still need a stable namespace, but it must be
     // isolated by deployment and tenant. Once an authenticated identity is
     // installed, applyAuth switches away from this scope before restoring or
-    // sending its durable mutations.
+    // sending its durable reducers.
     return ["anonymous", url, auth.project ?? "", auth.tenant ?? ""].join("\u0000");
 }
 function isEphemeralOutboxScope(scope) {
     return scope.startsWith("ephemeral-auth\u0000");
 }
-function queryCacheDirectiveFromAuthResult(result) {
-    if (!isJsonRecord(result))
-        return undefined;
-    return validQueryCacheDirective(result.queryCache) ? result.queryCache : undefined;
-}
-function validQueryCacheDirective(value) {
-    if (!isJsonRecord(value))
-        return false;
-    return value.protocolVersion === 1
-        && typeof value.scope === "string"
-        && value.scope.length >= 16
-        && (value.syncScope === undefined
-            || (typeof value.syncScope === "string" && value.syncScope.length >= 16))
-        && typeof value.epoch === "string"
-        && value.epoch.length >= 16
-        && typeof value.maxAgeMs === "number"
-        && Number.isFinite(value.maxAgeMs)
-        && value.maxAgeMs > 0;
-}
-/**
- * The scope under which sync collections are persisted and resumed. Newer
- * runtimes send a visibility-only `syncScope` that survives deploys (the
- * authoritative reconcile on resume guarantees correctness across code
- * changes); older runtimes only send the bundle-epoch `scope`.
- */
-function syncPersistenceScope(directive) {
-    return typeof directive.syncScope === "string" && directive.syncScope.length >= 16
-        ? directive.syncScope
-        : directive.scope;
-}
 function isJsonRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
+function replicaDirectiveFromAuthResult(result) {
+    if (!isJsonRecord(result) || !isJsonRecord(result.replica))
+        return undefined;
+    const directive = result.replica;
+    if (directive.protocolVersion !== 1
+        || typeof directive.scope !== "string"
+        || typeof directive.visibilityScope !== "string"
+        || typeof directive.epoch !== "string")
+        return undefined;
+    return {
+        protocolVersion: 1,
+        scope: directive.scope,
+        visibilityScope: directive.visibilityScope,
+        epoch: directive.epoch,
+    };
+}
+function developerSessionTokenFromAuthResult(result) {
+    if (!isJsonRecord(result))
+        return undefined;
+    const token = result.developerSessionToken;
+    return typeof token === "string" && token.startsWith("gvx_dev_") ? token : undefined;
+}
 function hasOwn(value, key) {
     return Object.prototype.hasOwnProperty.call(value, key);
 }
-function toWebSocketURL(url, project) {
-    const wsURL = url.startsWith("ws://") || url.startsWith("wss://")
-        ? new URL(url)
-        : new URL(`${url.replace(/^http:/, "ws:").replace(/^https:/, "wss:").replace(/\/$/, "")}/ws`);
-    if (project && !wsURL.searchParams.has("project")) {
-        wsURL.searchParams.set("project", project);
-    }
-    return wsURL.toString();
-}
 function randomID() {
     const randomUUID = globalThis.crypto?.randomUUID;
     if (randomUUID)
@@ -2728,12 +2771,6 @@ function nowMs() {
     }
     return Date.now();
 }
-function queryCacheReadTimeout(value) {
-    if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
-        return defaultQueryCacheReadTimeoutMs;
-    }
-    return value;
-}
 function browserTelemetryInfo() {
     const navigatorValue = globalThis.navigator;
     if (!navigatorValue)