@recordtimelabel/core 0.6.2 → 0.6.4

package/src/index.js

@@ -1,33 +1,47 @@
 import {
   RECORD_TIMELABEL_CAPABILITY_CLOUD_FAILURE_STATE,
+  RECORD_TIMELABEL_CAPABILITY_DETERMINISTIC_PLANNER,
   RECORD_TIMELABEL_CAPABILITY_LIFECYCLE_GENERATION_FENCE,
+  RECORD_TIMELABEL_CAPABILITY_LIFECYCLE_GENERATION_FENCE_V1,
   RECORD_TIMELABEL_CAPABILITY_OPERATION_CONFLICT_QUARANTINE,
   RECORD_TIMELABEL_CAPABILITY_STRICT_OPERATION_RESULTS,
+  RECORD_TIMELABEL_CAPABILITY_STRICT_READINESS,
+  RECORD_TIMELABEL_CLOUD_FAILURE_SCHEMA_VERSION,
   RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES,
   RECORD_TIMELABEL_OPERATION_RESULT_STATUSES,
   RECORD_TIMELABEL_PROTOCOL_CAPABILITIES,
   buildRecordTimeLabelRequestId,
   createRecordTimeLabelTransportFailureResults,
+  isRecordTimeLabelOperationConflictFailure,
   normalizeRecordTimeLabelCloudFailure,
   normalizeRecordTimeLabelEnvelopeResponse,
   normalizeRecordTimeLabelOperationResults,
+  normalizeRecordTimeLabelImmutableId,
+  normalizeRecordTimeLabelPlannerId,
   toRecordTimeLabelCloudFailureError,
   toRecordTimeLabelWireOperation
 } from './protocol.js';
 
 export {
   RECORD_TIMELABEL_CAPABILITY_CLOUD_FAILURE_STATE,
+  RECORD_TIMELABEL_CAPABILITY_DETERMINISTIC_PLANNER,
   RECORD_TIMELABEL_CAPABILITY_LIFECYCLE_GENERATION_FENCE,
+  RECORD_TIMELABEL_CAPABILITY_LIFECYCLE_GENERATION_FENCE_V1,
   RECORD_TIMELABEL_CAPABILITY_OPERATION_CONFLICT_QUARANTINE,
   RECORD_TIMELABEL_CAPABILITY_STRICT_OPERATION_RESULTS,
+  RECORD_TIMELABEL_CAPABILITY_STRICT_READINESS,
+  RECORD_TIMELABEL_CLOUD_FAILURE_SCHEMA_VERSION,
   RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES,
   RECORD_TIMELABEL_OPERATION_RESULT_STATUSES,
   RECORD_TIMELABEL_PROTOCOL_CAPABILITIES,
   buildRecordTimeLabelRequestId,
   createRecordTimeLabelTransportFailureResults,
+  isRecordTimeLabelOperationConflictFailure,
   normalizeRecordTimeLabelCloudFailure,
   normalizeRecordTimeLabelEnvelopeResponse,
   normalizeRecordTimeLabelOperationResults,
+  normalizeRecordTimeLabelImmutableId,
+  normalizeRecordTimeLabelPlannerId,
   toRecordTimeLabelCloudFailureError,
   toRecordTimeLabelWireOperation
 } from './protocol.js';
@@ -127,7 +141,7 @@ export {
   selectBestMatchingTwitchVod
 };
 
-export const RECORD_TIMELABEL_CORE_VERSION = '0.6.2';
+export const RECORD_TIMELABEL_CORE_VERSION = '0.6.4';
 export const RTL_SYNC_PROTOCOL_VERSION = 2;
 export const RECORD_TIMELABEL_DURABLE_ENGINE_CAPABILITIES = Object.freeze([
   'fifo-retry-fence',
@@ -137,7 +151,10 @@ export const RECORD_TIMELABEL_DURABLE_ENGINE_CAPABILITIES = Object.freeze([
   RECORD_TIMELABEL_CAPABILITY_OPERATION_CONFLICT_QUARANTINE,
   RECORD_TIMELABEL_CAPABILITY_STRICT_OPERATION_RESULTS,
   RECORD_TIMELABEL_CAPABILITY_LIFECYCLE_GENERATION_FENCE,
-  RECORD_TIMELABEL_CAPABILITY_CLOUD_FAILURE_STATE
+  RECORD_TIMELABEL_CAPABILITY_LIFECYCLE_GENERATION_FENCE_V1,
+  RECORD_TIMELABEL_CAPABILITY_CLOUD_FAILURE_STATE,
+  RECORD_TIMELABEL_CAPABILITY_DETERMINISTIC_PLANNER,
+  RECORD_TIMELABEL_CAPABILITY_STRICT_READINESS
 ]);
 export const RTL_MAX_OPERATIONS_PER_REQUEST = 20;
 export const RTL_MAX_SYNC_DRAIN_ROUNDS = 50;
@@ -145,6 +162,11 @@ export const RTL_SYNC_DRAIN_RETRY_DELAY_MS = 1000;
 export const RTL_MAX_REQUEST_BYTES = 256 * 1024;
 export const RTL_MAX_TARGET_WRITES = 100;
 export const RTL_TRASH_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
+export const RECORD_TIMELABEL_PLANNER_MODES = Object.freeze({
+  DETERMINISTIC: 'deterministic',
+  LEGACY_CONTEXT: 'legacy-context'
+});
+export const RECORD_TIMELABEL_SAFE_ID_MAX_BYTES = 512;
 
 export const OPERATION_TYPES = Object.freeze({
   RECORD_CREATE: 'record.create',
@@ -195,6 +217,7 @@ export const RECORD_TIMELABEL_OPERATION_IDENTITY_REASONS = Object.freeze({
   OWNER_MISMATCH: 'operation_owner_mismatch',
   WORKSPACE_EPOCH_MISMATCH: 'operation_workspace_epoch_mismatch',
   ID_CONFLICT: 'operation_id_conflict',
+  INVALID_DOCUMENT_ID: 'invalid_document_id',
   LIFECYCLE_GENERATION_REQUIRED: 'lifecycle_generation_required',
   LIFECYCLE_CONFLICT: 'lifecycle_conflict'
 });
@@ -211,7 +234,20 @@ const clone = (value, seen = new WeakMap()) => {
   const copy = Array.isArray(value) ? [] : {};
   seen.set(value, copy);
   Reflect.ownKeys(value).forEach((key) => {
-    copy[key] = clone(value[key], seen);
+    // Assignment to the magic `__proto__` key invokes the legacy setter on a
+    // normal object. Define the data property explicitly so cloning untrusted
+    // document maps cannot alter the clone's prototype (or any global
+    // prototype through a later merge).
+    if (Array.isArray(copy) && key === 'length') {
+      copy.length = value.length;
+      return;
+    }
+    Object.defineProperty(copy, key, {
+      value: clone(value[key], seen),
+      enumerable: true,
+      configurable: true,
+      writable: true
+    });
   });
   return copy;
 };
@@ -284,9 +320,21 @@ const normalizeId = (value) => {
   return String(value).trim();
 };
 
+const RTL_RESERVED_DOCUMENT_KEYS = new Set(['__proto__', 'prototype', 'constructor']);
+const RTL_SAFE_DOCUMENT_ID_MAX_BYTES = 512;
+const rtlIsSafeDocumentId = (value) => {
+  // Document identity is a wire-level string. Never coerce numbers (or trim
+  // any other value) before applying the shared immutable-ID contract.
+  if (typeof value !== 'string') return false;
+  const normalized = normalizeRecordTimeLabelImmutableId(value);
+  return normalized !== null && !RTL_RESERVED_DOCUMENT_KEYS.has(normalized);
+};
+
 const safeFolderId = (folderId) => {
   const normalized = normalizeId(folderId);
-  if (!normalized || VIRTUAL_FOLDER_IDS.has(normalized)) return DEFAULT_FOLDER_ID;
+  if (!normalized || !rtlIsSafeDocumentId(normalized) || VIRTUAL_FOLDER_IDS.has(normalized)) {
+    return DEFAULT_FOLDER_ID;
+  }
   return normalized;
 };
 
@@ -316,7 +364,7 @@ const normalizeTombstones = (value) => {
 
   return entries.reduce((result, [rawId, rawTombstone]) => {
     const id = normalizeId(rawId);
-    if (!id) return result;
+    if (!id || !rtlIsSafeDocumentId(id)) return result;
     const tombstone = rawTombstone && typeof rawTombstone === 'object'
       ? { ...rawTombstone }
       : {};
@@ -341,7 +389,8 @@ const normalizeTrashEntries = (value) => {
     const id = normalizeId(rawId || rawEntry.id);
     const kind = normalizeId(rawEntry.kind);
     const entityId = normalizeId(rawEntry.entityId);
-    if (!id || !entityId || !new Set(['record', 'folder']).has(kind)) return result;
+    if (!id || !entityId || !rtlIsSafeDocumentId(id) || !rtlIsSafeDocumentId(entityId) ||
+      !new Set(['record', 'folder']).has(kind)) return result;
     const deletedAt = toFiniteTimestamp(rawEntry.deletedAt);
     const purgeAt = toFiniteTimestamp(rawEntry.purgeAt) ||
       ((deletedAt || Date.now()) + RTL_TRASH_RETENTION_MS);
@@ -366,7 +415,7 @@ export const getActiveTrashEntries = (value, now = Date.now()) => Object.values(
 const mergeTombstones = (left = {}, right = {}) => {
   const merged = { ...left };
   Object.entries(right).forEach(([id, tombstone]) => {
-    const current = merged[id];
+    const current = rtlOwn(merged, id) ? merged[id] : null;
     const currentGeneration = Number(current?.lifecycleGeneration || 0);
     const nextGeneration = Number(tombstone?.lifecycleGeneration || 0);
     if (!current || nextGeneration > currentGeneration ||
@@ -381,7 +430,7 @@ const mergeTombstones = (left = {}, right = {}) => {
 const mergeTrashEntries = (remoteEntries = {}, localEntries = {}) => {
   const merged = normalizeTrashEntries(remoteEntries);
   Object.entries(normalizeTrashEntries(localEntries)).forEach(([id, entry]) => {
-    const current = merged[id];
+    const current = rtlOwn(merged, id) ? merged[id] : null;
     const currentVersion = Number(current?.lifecycleGeneration || 0);
     const nextVersion = Number(entry.lifecycleGeneration || 0);
     if (!current || nextVersion > currentVersion ||
@@ -517,10 +566,37 @@ export const mergeRecords = (left, right) => {
     }
   });
 
-  if (left.hasVod || right.hasVod) merged.hasVod = true;
   return merged;
 };
 
+/**
+ * Apply a user-authored record patch without using enrichment/LWW merge
+ * semantics.  The latter intentionally keeps rich fields from either side,
+ * which is correct for remote snapshot reconciliation but would make an
+ * explicit `{hasVod: false}` or `{title: ''}` impossible to persist.  An
+ * explicit patch is presence-based: omitted keys are retained, while every
+ * own key (including `undefined`, `null`, `false`, and the empty string) is
+ * authoritative for this operation.
+ */
+export const applyExplicitRecordUpdate = (record = {}, patch = {}, operationTime = Date.now()) => {
+  const current = record && typeof record === 'object' ? record : {};
+  const source = patch && typeof patch === 'object' && !Array.isArray(patch) ? patch : {};
+  const next = {...current};
+  Object.keys(source).forEach((key) => {
+    if (RTL_RESERVED_DOCUMENT_KEYS.has(key)) return;
+    Object.defineProperty(next, key, {
+      value: source[key],
+      enumerable: true,
+      configurable: true,
+      writable: true
+    });
+  });
+  if (!Object.prototype.hasOwnProperty.call(source, 'updatedAt')) {
+    next.updatedAt = operationTime;
+  }
+  return next;
+};
+
 export const normalizeRecords = (records = {}, options = {}) => {
   const source = records && typeof records === 'object' ? records : {};
   const tombstones = normalizeTombstones(options.deletedRecordTombstones);
@@ -533,7 +609,7 @@ export const normalizeRecords = (records = {}, options = {}) => {
     safeList.forEach((record, index) => {
       if (!record || typeof record !== 'object') return;
       const id = normalizeId(record.id) || normalizeId(record.recordId);
-      if (!id) return;
+      if (!id || !rtlIsSafeDocumentId(id)) return;
 
       const targetFolderId = resolveRecordFolderId(folderId, record);
 
@@ -549,7 +625,7 @@ export const normalizeRecords = (records = {}, options = {}) => {
       const folderTombstone = folderTombstones[targetFolderId];
       if (folderTombstone) return;
 
-      if (!normalized[targetFolderId]) normalized[targetFolderId] = [];
+      if (!rtlOwn(normalized, targetFolderId)) normalized[targetFolderId] = [];
 
       const existing = placements.get(id);
       if (!existing) {
@@ -598,7 +674,7 @@ const ensureFolders = (folders = []) => {
   toArray(folders).forEach((folder) => {
     if (!folder || typeof folder !== 'object') return;
     const id = normalizeId(folder.id);
-    if (!id || seen.has(id)) return;
+    if (!id || !rtlIsSafeDocumentId(id) || seen.has(id)) return;
     seen.add(id);
     nextFolders.push({ ...folder, id });
   });
@@ -625,10 +701,10 @@ const ensureFolders = (folders = []) => {
 const ensureRecordFolders = (records, folders) => {
   const nextRecords = { ...records };
   folders.forEach((folder) => {
-    if (!nextRecords[folder.id]) nextRecords[folder.id] = [];
+    if (!rtlOwn(nextRecords, folder.id)) nextRecords[folder.id] = [];
   });
-  if (!nextRecords.all) nextRecords.all = [];
-  if (!nextRecords[DEFAULT_FOLDER_ID]) nextRecords[DEFAULT_FOLDER_ID] = [];
+  if (!rtlOwn(nextRecords, 'all')) nextRecords.all = [];
+  if (!rtlOwn(nextRecords, DEFAULT_FOLDER_ID)) nextRecords[DEFAULT_FOLDER_ID] = [];
   nextRecords.all = [];
   return nextRecords;
 };
@@ -924,8 +1000,12 @@ export const applyOperation = (state = {}, operation = {}) => {
       const record = payload.record && typeof payload.record === 'object' ? { ...payload.record } : null;
       if (!record) return normalized;
       const recordId = normalizeId(record.id || payload.recordId);
-      if (!recordId) return normalized;
-      const tombstone = nextState.deletedRecordTombstones[recordId];
+      if (!recordId || !rtlIsSafeDocumentId(recordId)) return normalized;
+      const rawFolderId = normalizeId(payload.folderId || record.folderId);
+      if (rawFolderId && !rtlIsSafeDocumentId(rawFolderId)) return normalized;
+      const tombstone = rtlOwn(nextState.deletedRecordTombstones, recordId)
+        ? nextState.deletedRecordTombstones[recordId]
+        : null;
       if (tombstone) return normalized;
 
       const folderId = safeFolderId(payload.folderId || record.folderId);
@@ -946,24 +1026,25 @@ export const applyOperation = (state = {}, operation = {}) => {
 
     case OPERATION_TYPES.RECORD_UPDATE: {
       const recordId = normalizeId(payload.recordId || payload.id || payload.record?.id);
-      if (!recordId) return normalized;
+      if (!recordId || !rtlIsSafeDocumentId(recordId)) return normalized;
       const entry = findRecordEntry(nextState.records, recordId);
       if (!entry) return normalized;
       const patch = payload.patch || payload.record || {};
-      const updatedRecord = mergeRecords(entry.record, {
-        ...entry.record,
-        ...patch,
-        id: recordId,
-        updatedAt: patch.updatedAt || operationTime
-      });
+      if (Object.keys(patch).some((key) => RTL_RESERVED_DOCUMENT_KEYS.has(key))) {
+        return normalized;
+      }
+      const updatedRecord = applyExplicitRecordUpdate(entry.record, patch, operationTime);
+      updatedRecord.id = recordId;
       nextState.records[entry.folderId][entry.index] = updatedRecord;
       break;
     }
 
     case OPERATION_TYPES.RECORD_MOVE: {
       const recordId = normalizeId(payload.recordId || payload.id || payload.record?.id);
-      const targetFolderId = safeFolderId(payload.targetFolderId || payload.folderId);
-      if (!recordId) return normalized;
+      const rawTargetFolderId = normalizeId(payload.targetFolderId || payload.folderId);
+      if (!recordId || !rtlIsSafeDocumentId(recordId) ||
+        (rawTargetFolderId && !rtlIsSafeDocumentId(rawTargetFolderId))) return normalized;
+      const targetFolderId = safeFolderId(rawTargetFolderId);
       const entry = findRecordEntry(nextState.records, recordId);
       if (!entry) return normalized;
       const movedRecord = {
@@ -981,7 +1062,9 @@ export const applyOperation = (state = {}, operation = {}) => {
     }
 
     case OPERATION_TYPES.RECORD_REORDER: {
-      const folderId = safeFolderId(payload.folderId);
+      const rawFolderId = normalizeId(payload.folderId);
+      if (rawFolderId && !rtlIsSafeDocumentId(rawFolderId)) return normalized;
+      const folderId = safeFolderId(rawFolderId);
       const existingFolderRecords = toArray(nextState.records?.[folderId]);
       const payloadRecords = toArray(payload.records);
       const recordsById = new Map();
@@ -1007,6 +1090,7 @@ export const applyOperation = (state = {}, operation = {}) => {
           ? payload.recordIds
           : payloadRecords.map((record) => getRecordId(record))
       );
+      if (orderedIds.some((id) => !rtlIsSafeDocumentId(id))) return normalized;
       if (orderedIds.length === 0) return normalized;
 
       const seen = new Set();
@@ -1030,13 +1114,21 @@ export const applyOperation = (state = {}, operation = {}) => {
 
     case OPERATION_TYPES.RECORD_DELETE: {
       const recordId = normalizeId(payload.recordId || payload.id);
-      if (!recordId) return normalized;
+      if (!recordId || !rtlIsSafeDocumentId(recordId)) return normalized;
       const existingEntry = findRecordEntry(nextState.records, recordId);
       const recordSnapshot = payload.record && typeof payload.record === 'object'
         ? {...payload.record, id: recordId}
         : existingEntry?.record;
       const trashEntryId = normalizeId(payload.trashEntryId) || `record:${recordId}`;
-      if (!recordSnapshot && nextState.trashEntries[trashEntryId]) return normalized;
+      if (!rtlIsSafeDocumentId(trashEntryId)) return normalized;
+      const existingTombstone = nextState.deletedRecordTombstones[recordId];
+      if (!recordSnapshot && (nextState.trashEntries[trashEntryId] || existingTombstone)) {
+        return normalized;
+      }
+      if (recordSnapshot && existingTombstone && Number(existingTombstone.lifecycleGeneration || 0) >=
+        Number(recordSnapshot.lifecycleGeneration || 0)) {
+        return normalized;
+      }
       const deletedAt = toFiniteTimestamp(payload.deletedAt) || operationTime;
       const previousGeneration = Math.max(
         Number(recordSnapshot?.lifecycleGeneration || 0),
@@ -1071,16 +1163,29 @@ export const applyOperation = (state = {}, operation = {}) => {
     }
 
     case OPERATION_TYPES.RECORD_RESTORE: {
+      const restoreRecordId = normalizeId(payload.recordId || payload.id);
       const trashEntryId = normalizeId(payload.trashEntryId) ||
-        `record:${normalizeId(payload.recordId || payload.id)}`;
-      const trashEntry = nextState.trashEntries[trashEntryId];
+        `record:${restoreRecordId}`;
+      if (!rtlIsSafeDocumentId(trashEntryId)) return normalized;
+      const trashEntry = rtlOwn(nextState.trashEntries, trashEntryId)
+        ? nextState.trashEntries[trashEntryId]
+        : null;
       if (!trashEntry || trashEntry.kind !== 'record') return normalized;
       if (toFiniteTimestamp(trashEntry.purgeAt) <= operationTime) return normalized;
       const expectedGeneration = normalizeExpectedGeneration(payload.expectedGeneration);
       if (expectedGeneration === null ||
         expectedGeneration !== Number(trashEntry.lifecycleGeneration)) return normalized;
       const recordId = normalizeId(trashEntry.entityId);
-      if (!recordId || findRecordEntry(nextState.records, recordId)) return normalized;
+      if (!recordId || !rtlIsSafeDocumentId(recordId) || findRecordEntry(nextState.records, recordId)) {
+        return normalized;
+      }
+      const lifecycleTombstone = rtlOwn(nextState.deletedRecordTombstones, recordId)
+        ? nextState.deletedRecordTombstones[recordId]
+        : null;
+      if (!lifecycleTombstone ||
+        Number(lifecycleTombstone.lifecycleGeneration) !== Number(trashEntry.lifecycleGeneration)) {
+        return normalized;
+      }
       const recordSnapshot = trashEntry.payload?.record;
       if (!recordSnapshot) return normalized;
       const originalFolderId = safeFolderId(trashEntry.originalFolderId);
@@ -1109,8 +1214,9 @@ export const applyOperation = (state = {}, operation = {}) => {
     case OPERATION_TYPES.FOLDER_CREATE: {
       const folder = payload.folder && typeof payload.folder === 'object' ? { ...payload.folder } : null;
       const folderId = normalizeId(folder?.id || payload.folderId);
-      if (!folderId) return normalized;
-      if (nextState.deletedFolderTombstones[folderId]) return normalized;
+      if (!folderId || !rtlIsSafeDocumentId(folderId)) return normalized;
+      if (rtlOwn(nextState.deletedFolderTombstones, folderId) &&
+        nextState.deletedFolderTombstones[folderId]) return normalized;
       const existingIndex = nextState.folders.findIndex((item) => item.id === folderId);
       const nextFolder = {
         ...(folder || {}),
@@ -1128,7 +1234,7 @@ export const applyOperation = (state = {}, operation = {}) => {
 
     case OPERATION_TYPES.FOLDER_UPDATE: {
       const folderId = normalizeId(payload.folderId || payload.id || payload.folder?.id);
-      if (!folderId) return normalized;
+      if (!folderId || !rtlIsSafeDocumentId(folderId)) return normalized;
       const patch = payload.patch || payload.folder || {};
       nextState.folders = nextState.folders.map((folder) => (
         folder.id === folderId
@@ -1140,12 +1246,24 @@ export const applyOperation = (state = {}, operation = {}) => {
 
     case OPERATION_TYPES.FOLDER_DELETE: {
       const folderId = normalizeId(payload.folderId || payload.id);
-      if (!folderId || folderId === 'all' || folderId === DEFAULT_FOLDER_ID) return normalized;
+      if (!folderId || !rtlIsSafeDocumentId(folderId) ||
+        folderId === 'all' || folderId === DEFAULT_FOLDER_ID) return normalized;
       const folderSnapshot = payload.folder && typeof payload.folder === 'object'
         ? {...payload.folder, id: folderId}
         : nextState.folders.find((folder) => folder.id === folderId);
       const folderRecords = toArray(payload.records || nextState.records[folderId]).map((record) => ({...record}));
-      if (!folderSnapshot && nextState.trashEntries[`folder:${folderId}`]) return normalized;
+      const existingTombstone = rtlOwn(nextState.deletedFolderTombstones, folderId)
+        ? nextState.deletedFolderTombstones[folderId]
+        : null;
+      if (!folderSnapshot &&
+        ((rtlOwn(nextState.trashEntries, `folder:${folderId}`) &&
+          nextState.trashEntries[`folder:${folderId}`]) || existingTombstone)) {
+        return normalized;
+      }
+      if (folderSnapshot && existingTombstone && Number(existingTombstone.lifecycleGeneration || 0) >=
+        Number(folderSnapshot.lifecycleGeneration || 0)) {
+        return normalized;
+      }
       const deletedAt = toFiniteTimestamp(payload.deletedAt) || operationTime;
       const previousGeneration = Math.max(
         Number(folderSnapshot?.lifecycleGeneration || 0),
@@ -1154,6 +1272,7 @@ export const applyOperation = (state = {}, operation = {}) => {
       const lifecycleGeneration = previousGeneration + 1;
       if (folderSnapshot) {
         const trashEntryId = normalizeId(payload.trashEntryId) || `folder:${folderId}`;
+        if (!rtlIsSafeDocumentId(trashEntryId)) return normalized;
         nextState.trashEntries[trashEntryId] = {
           id: trashEntryId,
           kind: 'folder',
@@ -1187,7 +1306,7 @@ export const applyOperation = (state = {}, operation = {}) => {
       };
       folderRecords.forEach((record) => {
         const recordId = getRecordId(record);
-        if (!recordId) return;
+        if (!recordId || !rtlIsSafeDocumentId(recordId)) return;
         nextState.deletedRecordTombstones[recordId] = {
           id: recordId,
           folderId,
@@ -1201,16 +1320,28 @@ export const applyOperation = (state = {}, operation = {}) => {
     }
 
     case OPERATION_TYPES.FOLDER_RESTORE: {
+      const restoreFolderId = normalizeId(payload.folderId || payload.id);
       const trashEntryId = normalizeId(payload.trashEntryId) ||
-        `folder:${normalizeId(payload.folderId || payload.id)}`;
-      const trashEntry = nextState.trashEntries[trashEntryId];
+        `folder:${restoreFolderId}`;
+      if (!rtlIsSafeDocumentId(trashEntryId)) return normalized;
+      const trashEntry = rtlOwn(nextState.trashEntries, trashEntryId)
+        ? nextState.trashEntries[trashEntryId]
+        : null;
       if (!trashEntry || trashEntry.kind !== 'folder') return normalized;
       if (toFiniteTimestamp(trashEntry.purgeAt) <= operationTime) return normalized;
       const expectedGeneration = normalizeExpectedGeneration(payload.expectedGeneration);
       if (expectedGeneration === null ||
         expectedGeneration !== Number(trashEntry.lifecycleGeneration)) return normalized;
       const folderId = normalizeId(trashEntry.entityId);
-      if (!folderId || nextState.folders.some((folder) => folder.id === folderId)) return normalized;
+      if (!folderId || !rtlIsSafeDocumentId(folderId) ||
+        nextState.folders.some((folder) => folder.id === folderId)) return normalized;
+      const lifecycleTombstone = rtlOwn(nextState.deletedFolderTombstones, folderId)
+        ? nextState.deletedFolderTombstones[folderId]
+        : null;
+      if (!lifecycleTombstone ||
+        Number(lifecycleTombstone.lifecycleGeneration) !== Number(trashEntry.lifecycleGeneration)) {
+        return normalized;
+      }
       const folderSnapshot = trashEntry.payload?.folder;
       if (!folderSnapshot) return normalized;
       const lifecycleGeneration = Number(trashEntry.lifecycleGeneration || 0) + 1;
@@ -1299,6 +1430,7 @@ export const applyOperation = (state = {}, operation = {}) => {
 
     case OPERATION_TYPES.FOLDER_REORDER:
       nextState.folderOrder = normalizeOrder(payload.folderOrder || payload.order);
+      if (nextState.folderOrder.some((id) => !rtlIsSafeDocumentId(id))) return normalized;
       break;
 
     case OPERATION_TYPES.GROUP_REORDER:
@@ -1406,6 +1538,11 @@ export const mergeLocalRemote = ({
     });
   });
 
+  // Pending operations are explicit local commands. Replay them against the
+  // merged remote baseline in FIFO order; do not apply the remote document's
+  // LWW timestamp as a second gate, or an offline update with an older
+  // createdAt would be silently lost. `applyExplicitRecordUpdate` preserves
+  // omitted properties while honoring present empty/false/null values.
   toArray(pendingOps).forEach((operation) => {
     mergedState = applyOperation(mergedState, operation);
   });
@@ -1740,7 +1877,9 @@ const reorderV2RecordsByFolderRecordOrder = (records = {}, recordOrderByFolder =
 
 const cleanV2RecordDocument = (record = {}, folderId, now) => {
   const recordId = normalizeId(record.id);
-  if (!recordId) return null;
+  if (!recordId || !rtlIsSafeDocumentId(recordId)) return null;
+  const normalizedFolderId = normalizeId(folderId);
+  if (normalizedFolderId && !rtlIsSafeDocumentId(normalizedFolderId)) return null;
   const cleanRecord = { ...record, id: recordId, folderId: safeFolderId(folderId) };
   delete cleanRecord.pendingSync;
   delete cleanRecord.syncAttempts;
@@ -1753,7 +1892,7 @@ const cleanV2RecordDocument = (record = {}, folderId, now) => {
 
 const cleanV2FolderDocument = (folder = {}, now) => {
   const folderId = normalizeId(folder.id);
-  if (!folderId) return null;
+  if (!folderId || !rtlIsSafeDocumentId(folderId)) return null;
   const {
     schemaVersion,
     recordOrder,
@@ -1771,7 +1910,7 @@ const cleanV2FolderDocument = (folder = {}, now) => {
 
 const cleanV2OperationDocument = (operation = {}, now) => {
   const operationId = normalizeId(operation.id);
-  if (!operationId || !operation.type) return null;
+  if (!operationId || !rtlIsSafeDocumentId(operationId) || !operation.type) return null;
   return {
     ...operation,
     id: operationId,
@@ -1783,7 +1922,8 @@ const cleanV2OperationDocument = (operation = {}, now) => {
 const cleanV2TrashDocument = (entry = {}, now) => {
   const normalized = normalizeTrashEntries({[entry?.id || '']: entry});
   const trashEntry = Object.values(normalized)[0];
-  if (!trashEntry) return null;
+  if (!trashEntry || !rtlIsSafeDocumentId(trashEntry.id) ||
+    !rtlIsSafeDocumentId(trashEntry.entityId)) return null;
   return {
     ...trashEntry,
     deletedAt: trashEntry.deletedAt || now,
@@ -1799,6 +1939,7 @@ const buildV2LifecycleTombstoneDocuments = (
   const documents = {};
   const append = (kind, tombstones) => {
     Object.entries(normalizeTombstones(tombstones)).forEach(([entityId, tombstone]) => {
+      if (!rtlIsSafeDocumentId(entityId)) return;
       const id = `${kind}:${entityId}`;
       documents[encodeURIComponent(id)] = {
         id,
@@ -3010,6 +3151,168 @@ const RTL_COMPLETED_OPERATION_FINGERPRINT_LIMIT = 512;
 
 const rtlDurableIsObject = (value) => Boolean(value && typeof value === 'object' && !Array.isArray(value));
 
+const rtlRawNonNegativeSafeInteger = (value) => (
+  typeof value === 'number' && Number.isSafeInteger(value) && value >= 0
+);
+
+const rtlRawSafeId = (value) => typeof value === 'string' && rtlIsSafeDocumentId(value);
+
+const rtlRawFiniteTimestamp = (value) => (
+  typeof value === 'number' && Number.isFinite(value)
+);
+
+const rtlRawValidOpaqueGroupOrder = (value) => (
+  typeof value === 'string' && value.length > 0 &&
+  new TextEncoder().encode(value).byteLength <= RTL_SAFE_DOCUMENT_ID_MAX_BYTES &&
+  !/[\u0000-\u001F\u007F-\u009F]/u.test(value)
+);
+
+const rtlRawValidOrder = (value, {opaqueGroup = false} = {}) => (
+  Array.isArray(value) && value.every((id) => (
+    opaqueGroup ? rtlRawValidOpaqueGroupOrder(id) : rtlRawSafeId(id)
+  ))
+);
+
+const rtlRawValidTombstoneTable = (value) => (
+  rtlDurableIsObject(value) && Object.entries(value).every(([id, tombstone]) => (
+    rtlRawSafeId(id) && rtlDurableIsObject(tombstone) &&
+    (!Object.prototype.hasOwnProperty.call(tombstone, 'id') || rtlRawSafeId(tombstone.id)) &&
+    Number.isSafeInteger(tombstone.lifecycleGeneration) && tombstone.lifecycleGeneration > 0 &&
+    rtlRawFiniteTimestamp(tombstone.deletedAt)
+  ))
+);
+
+const rtlRawValidTrashTable = (value) => (
+  rtlDurableIsObject(value) && Object.entries(value).every(([id, entry]) => (
+    rtlRawSafeId(id) && rtlDurableIsObject(entry) &&
+    rtlRawSafeId(entry.id) && entry.id === id &&
+    (entry.kind === 'record' || entry.kind === 'folder') &&
+    rtlRawSafeId(entry.entityId) &&
+    Number.isSafeInteger(entry.lifecycleGeneration) && entry.lifecycleGeneration > 0 &&
+    rtlRawFiniteTimestamp(entry.deletedAt) && rtlRawFiniteTimestamp(entry.purgeAt) &&
+    (!Object.prototype.hasOwnProperty.call(entry, 'payload') || rtlDurableIsObject(entry.payload))
+  ))
+);
+
+const rtlHasCompleteBaselineState = (state) => {
+  if (!rtlDurableIsObject(state) || ![
+    'folders', 'records', 'groupOrder', 'folderOrder', 'settings', 'rtlSyncMeta',
+    'deletedRecordTombstones', 'deletedFolderTombstones', 'trashEntries'
+  ].every((key) => Object.prototype.hasOwnProperty.call(state, key))) return false;
+  if (!Array.isArray(state.folders) || !rtlDurableIsObject(state.records) ||
+    !rtlRawValidOrder(state.groupOrder, {opaqueGroup: true}) || !rtlRawValidOrder(state.folderOrder) ||
+    !rtlDurableIsObject(state.settings) || !rtlDurableIsObject(state.rtlSyncMeta) ||
+    !rtlRawValidTombstoneTable(state.deletedRecordTombstones) ||
+    !rtlRawValidTombstoneTable(state.deletedFolderTombstones) ||
+    !rtlRawValidTrashTable(state.trashEntries)) return false;
+
+  const folderIds = new Set();
+  for (const folder of state.folders) {
+    if (!rtlDurableIsObject(folder) || !rtlRawSafeId(folder.id) || folderIds.has(folder.id) ||
+      (Object.prototype.hasOwnProperty.call(folder, 'recordOrder') && !rtlRawValidOrder(folder.recordOrder))) {
+      return false;
+    }
+    folderIds.add(folder.id);
+  }
+  const recordIds = new Set();
+  for (const [folderId, records] of Object.entries(state.records)) {
+    if (!rtlRawSafeId(folderId) || !Array.isArray(records)) return false;
+    for (const record of records) {
+      if (!rtlDurableIsObject(record) || !rtlRawSafeId(record.id) || recordIds.has(record.id)) {
+        return false;
+      }
+      recordIds.add(record.id);
+    }
+  }
+  return true;
+};
+
+// Resume cursors and markers are opaque to Core, but any identity fields an
+// adapter persists alongside them are still part of the workspace fence. A
+// cursor from another UID/session/epoch must force a fresh bootstrap rather
+// than being silently adopted after normalization.
+const rtlResumeIdentityMatches = (value, captured, ownerUid, workspaceEpoch) => {
+  if (value === null || value === undefined || !rtlDurableIsObject(value)) return false;
+  const hasOwnerIdentity = ['ownerUid', 'uid', 'workspaceOwnerUid']
+    .some((key) => Object.prototype.hasOwnProperty.call(value, key));
+  const hasEpochIdentity = ['workspaceEpoch', 'epoch']
+    .some((key) => Object.prototype.hasOwnProperty.call(value, key));
+  const hasSessionIdentity = ['authSessionBinding']
+    .some((key) => Object.prototype.hasOwnProperty.call(value, key));
+  if (!hasOwnerIdentity || !hasEpochIdentity || !hasSessionIdentity) return false;
+  for (const key of ['ownerUid', 'uid', 'workspaceOwnerUid']) {
+    if (Object.prototype.hasOwnProperty.call(value, key) &&
+      rtlNormalizeUid(value[key]) !== rtlNormalizeUid(ownerUid)) {
+      return false;
+    }
+  }
+  for (const key of ['workspaceEpoch', 'epoch']) {
+    if (Object.prototype.hasOwnProperty.call(value, key) &&
+      (!rtlRawNonNegativeSafeInteger(value[key]) ||
+        value[key] !== workspaceEpoch)) {
+      return false;
+    }
+  }
+  // Legacy sessionToken/sessionTokenId markers are credentials or opaque
+  // fences that cannot be safely persisted. They deliberately fail closed;
+  // callers must bootstrap and receive a newly bound marker.
+  if (Object.prototype.hasOwnProperty.call(value, 'sessionToken') ||
+    Object.prototype.hasOwnProperty.call(value, 'sessionTokenId')) return false;
+  for (const key of ['authSessionBinding']) {
+    if (Object.prototype.hasOwnProperty.call(value, key) &&
+      (captured?.authSessionBinding === undefined || captured?.authSessionBinding === null ||
+        !Object.is(value[key], captured.authSessionBinding))) {
+      return false;
+    }
+  }
+  return true;
+};
+
+const rtlResumeMarkerMatches = (value, captured, ownerUid, workspaceEpoch) =>
+  rtlResumeIdentityMatches(value, captured, ownerUid, workspaceEpoch);
+
+const rtlHasValidRawCommittedWorkspace = (loaded, captured) => {
+  if (!rtlDurableIsObject(loaded) || loaded.schemaVersion !== RTL_DURABLE_SCHEMA_VERSION) {
+    return false;
+  }
+  const ownerUid = rtlNormalizeUid(loaded.ownerUid);
+  const expectedOwnerUid = rtlNormalizeUid(captured?.uid);
+  if (!ownerUid || !expectedOwnerUid || ownerUid !== expectedOwnerUid) return false;
+  if (!rtlRawNonNegativeSafeInteger(loaded.workspaceEpoch) ||
+    (captured?.hasEpoch && loaded.workspaceEpoch !== captured.workspaceEpoch)) {
+    return false;
+  }
+  const baseline = loaded.remoteBaseline;
+  if (!rtlDurableIsObject(baseline) ||
+    !Object.prototype.hasOwnProperty.call(baseline, 'state') ||
+    !Object.prototype.hasOwnProperty.call(baseline, 'revision') ||
+    !Object.prototype.hasOwnProperty.call(baseline, 'changeCursor') ||
+    !rtlHasCompleteBaselineState(baseline.state) ||
+    !rtlRawNonNegativeSafeInteger(baseline.revision) ||
+    baseline.revision <= 0) {
+    return false;
+  }
+  if (!rtlResumeIdentityMatches(
+    baseline.changeCursor,
+    captured,
+    ownerUid,
+    loaded.workspaceEpoch
+  )) {
+    return false;
+  }
+  if (loaded.syncMeta !== undefined &&
+    !rtlDurableIsObject(loaded.syncMeta)) return false;
+  const resumeMarker = loaded.syncMeta?.resumeMarker ??
+    loaded.syncMeta?.resume ??
+    loaded.syncMeta?.bootstrapMarker;
+  return resumeMarker === undefined || rtlResumeMarkerMatches(
+    resumeMarker,
+    captured,
+    ownerUid,
+    loaded.workspaceEpoch
+  );
+};
+
 const rtlToFiniteNumber = (value, fallback = 0) => {
   const number = Number(value);
   return Number.isFinite(number) ? number : fallback;
@@ -3035,12 +3338,26 @@ const rtlNormalizeWorkspaceEpoch = (value, fallback = 0) => {
 
 const rtlCloneOperation = (operation) => clone(operation && typeof operation === 'object' ? operation : {});
 
+// Durable storage may contain adapter metadata at arbitrary nesting levels.  Strip
+// credential-shaped keys case/separator-insensitively, while retaining the explicit
+// non-credential authSessionBinding used to bind a committed workspace to a session.
+const rtlIsCredentialKey = (key) => {
+  const normalized = String(key).replace(/[\s_-]/g, '').toLowerCase();
+  if (normalized === 'authsessionbinding') return false;
+  return new Set([
+    'sessiontoken', 'sessiontokenid', 'sessionid', 'authtoken', 'accesstoken',
+    'refreshtoken', 'idtoken', 'authorization', 'credential', 'credentials',
+    'firebasecredential', 'jwttoken', 'bearertoken', 'accesskey', 'refreshkey',
+    'authsessionid', 'authsessionkey'
+  ]).has(normalized) || /(?:token|credential|authorization|secret)$/.test(normalized);
+};
+
 const rtlStripSessionTokens = (value) => {
   if (Array.isArray(value)) return value.map((entry) => rtlStripSessionTokens(entry));
   if (!rtlDurableIsObject(value)) return value;
   const result = {};
   Object.entries(value).forEach(([key, entry]) => {
-    if (key === 'sessionToken' || key === 'sessionTokenId' || key === 'authToken') return;
+    if (rtlIsCredentialKey(key)) return;
     result[key] = rtlStripSessionTokens(entry);
   });
   return result;
@@ -3056,35 +3373,6 @@ const rtlNormalizeOperation = (operation = {}, {
   const input = operation && typeof operation === 'object' ? operation : {};
   const payload = rtlDurableIsObject(input.payload) ? clone(input.payload) : {};
   const normalizedPayload = payload;
-  const trimPayloadId = (key) => {
-    if (Object.prototype.hasOwnProperty.call(normalizedPayload, key)) {
-      normalizedPayload[key] = normalizeId(normalizedPayload[key]) || normalizedPayload[key];
-    }
-  };
-  [
-    'recordId', 'folderId', 'targetFolderId', 'trashEntryId', 'batchId', 'id',
-    'clientInstanceId', 'instanceId'
-  ].forEach(trimPayloadId);
-  ['recordIds', 'folderOrder', 'groupOrder', 'expandedGroups', 'groupIds', 'ids'].forEach((key) => {
-    if (Array.isArray(normalizedPayload[key])) {
-      normalizedPayload[key] = normalizeIdList(normalizedPayload[key]);
-    }
-  });
-  if (rtlDurableIsObject(normalizedPayload.record)) {
-    normalizedPayload.record = clone(normalizedPayload.record);
-    if (Object.prototype.hasOwnProperty.call(normalizedPayload.record, 'id')) {
-      normalizedPayload.record.id = normalizeId(normalizedPayload.record.id) || normalizedPayload.record.id;
-    }
-    if (Object.prototype.hasOwnProperty.call(normalizedPayload.record, 'folderId')) {
-      normalizedPayload.record.folderId = normalizeId(normalizedPayload.record.folderId) || normalizedPayload.record.folderId;
-    }
-  }
-  if (rtlDurableIsObject(normalizedPayload.folder)) {
-    normalizedPayload.folder = clone(normalizedPayload.folder);
-    if (Object.prototype.hasOwnProperty.call(normalizedPayload.folder, 'id')) {
-      normalizedPayload.folder.id = normalizeId(normalizedPayload.folder.id) || normalizedPayload.folder.id;
-    }
-  }
 
   const operationNow = rtlToFiniteNumber(input.createdAt, NaN);
   const resolvedNow = Number.isFinite(operationNow)
@@ -3099,7 +3387,9 @@ const rtlNormalizeOperation = (operation = {}, {
 
   return {
     ...rtlStripSessionTokens(input),
-    id: normalizeId(input.id) || generatedId,
+    // Preserve supplied IDs byte-for-byte.  Validation/quarantine must see an
+    // invalid whitespace or hostile ID instead of receiving a silently rewritten one.
+    id: Object.prototype.hasOwnProperty.call(input, 'id') ? input.id : generatedId,
     type: typeof input.type === 'string' ? input.type.trim() : input.type,
     payload: normalizedPayload,
     clientId: resolvedClientId,
@@ -3132,10 +3422,12 @@ const rtlNormalizeRemoteBaseline = (value = {}) => {
   const baseline = rtlDurableIsObject(value) ? value : {};
   return {
     state: normalizeRecordTimeLabelDomainState(baseline.state || baseline.data || {}),
-    revision: Math.max(0, rtlToFiniteNumber(baseline.revision, 0)),
+    revision: rtlRawNonNegativeSafeInteger(baseline.revision) ? baseline.revision : 0,
     changeCursor: baseline.changeCursor === undefined || baseline.changeCursor === null
       ? null
-      : String(baseline.changeCursor)
+      : rtlDurableIsObject(baseline.changeCursor)
+        ? clone(baseline.changeCursor)
+        : String(baseline.changeCursor)
   };
 };
 
@@ -3212,6 +3504,29 @@ const rtlNormalizeDurableWorkspace = (input = {}, options = {}) => {
 };
 
 const rtlOperationIdentityReason = (operation, workspace) => {
+  const candidateIds = [
+    operation?.id,
+    operation?.payload?.recordId,
+    operation?.payload?.folderId,
+    operation?.payload?.targetFolderId,
+    operation?.payload?.trashEntryId,
+    operation?.payload?.record?.id,
+    operation?.payload?.folder?.id,
+    ...(Array.isArray(operation?.payload?.recordIds) ? operation.payload.recordIds : []),
+    ...(Array.isArray(operation?.payload?.folderOrder) ? operation.payload.folderOrder : [])
+  ];
+  if (candidateIds.some((value) => (
+    value !== undefined && value !== null &&
+    !rtlIsSafeDocumentId(value)
+  ))) {
+    return RECORD_TIMELABEL_OPERATION_IDENTITY_REASONS.INVALID_DOCUMENT_ID;
+  }
+  const groupOrder = Array.isArray(operation?.payload?.groupOrder)
+    ? operation.payload.groupOrder
+    : [];
+  if (groupOrder.some((value) => !rtlIsSafeOpaqueGroupId(value))) {
+    return RECORD_TIMELABEL_OPERATION_IDENTITY_REASONS.INVALID_DOCUMENT_ID;
+  }
   const operationOwnerUid = rtlNormalizeUid(operation?.ownerUid);
   const workspaceOwnerUid = rtlNormalizeUid(workspace?.ownerUid);
   if (operationOwnerUid && operationOwnerUid !== workspaceOwnerUid) {
@@ -3369,6 +3684,11 @@ const rtlExtractSession = (session, fallbackEpoch = 0) => {
     Object.prototype.hasOwnProperty.call(current, 'sessionToken')
     ? current.sessionToken
     : null;
+  // Durable resume proofs use an explicit, non-credential auth binding. The
+  // transport/session token remains an in-memory callback fence only.
+  const authSessionBinding = current && typeof current === 'object'
+    ? (current.authSessionBinding ?? current.authSessionId ?? current.authSessionKey ?? null)
+    : null;
   const uid = rtlNormalizeUid(current && typeof current === 'object'
     ? (current.uid ?? current.ownerUid)
     : null);
@@ -3380,6 +3700,9 @@ const rtlExtractSession = (session, fallbackEpoch = 0) => {
     current,
     hasSession: typeof session?.current === 'function',
     sessionToken,
+    authSessionBinding: typeof authSessionBinding === 'string' && authSessionBinding.trim()
+      ? authSessionBinding
+      : null,
     uid,
     workspaceEpoch: hasEpoch
       ? rtlNormalizeWorkspaceEpoch(rawEpoch, fallbackEpoch)
@@ -3405,18 +3728,54 @@ const rtlSessionContext = (captured, workspace, client) => ({
 });
 
 const rtlEnvelopePayload = (value) => {
+  const normalizeRevisionAlias = (candidate) => {
+    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
+      return candidate;
+    }
+    if (
+      !Object.prototype.hasOwnProperty.call(candidate, 'revision') &&
+      Object.prototype.hasOwnProperty.call(candidate, 'remoteRevision')
+    ) {
+      return {...candidate, revision: candidate.remoteRevision};
+    }
+    return candidate;
+  };
   if (value && typeof value === 'object') {
-    if (value.remoteBaseline) return value.remoteBaseline;
-    if (value.baseline) return value.baseline;
-    if (value.state !== undefined || value.data !== undefined || value.revision !== undefined || value.changeCursor !== undefined) {
-      return value;
+    if (value.remoteBaseline) return normalizeRevisionAlias(value.remoteBaseline);
+    if (value.baseline) return normalizeRevisionAlias(value.baseline);
+    // A canonical failure may carry an authoritative baseline for an
+    // operation-id conflict.  It must win over compatibility state fields
+    // left beside `failure`; otherwise a stale outer state can be applied
+    // while the canonical failure is being handled.
+    if (value.failure && typeof value.failure === 'object') {
+      const nested = rtlEnvelopePayload(value.failure);
+      if (nested) return nested;
+    }
+    if (
+      value.state !== undefined ||
+      value.data !== undefined ||
+      value.revision !== undefined ||
+      value.remoteRevision !== undefined ||
+      value.changeCursor !== undefined
+    ) {
+      return normalizeRevisionAlias(value);
+    }
+    if (value.snapshot && typeof value.snapshot === 'object') {
+      return normalizeRevisionAlias(value.snapshot);
+    }
+    if (value.error && typeof value.error === 'object') {
+      const nested = rtlEnvelopePayload(value.error);
+      if (nested) return nested;
     }
-    if (value.snapshot && typeof value.snapshot === 'object') return value.snapshot;
     // Adapters migrating from the v1 cloud port may still return a raw
     // normalized state. Treat the presence of state-owned keys as an implicit
     // baseline with the persisted revision.
     if (value.folders !== undefined || value.records !== undefined || value.settings !== undefined) {
-      return {state: value, revision: value.revision, changeCursor: value.changeCursor};
+      return {
+        state: value,
+        revision: value.revision ?? value.remoteRevision,
+        changeCursor: value.changeCursor
+      };
     }
   }
   return null;
@@ -3424,44 +3783,63 @@ const rtlEnvelopePayload = (value) => {
 
 const rtlEnvelopeSuccess = (value) => {
   if (!value || typeof value !== 'object') return false;
-  if (value.success === false || value.ok === false || value.error || value.code === 'error') return false;
+  if (
+    value.success === false ||
+    value.ok === false ||
+    value.error ||
+    value.failure ||
+    value.code === 'error'
+  ) return false;
   return value.success === true || value.ok === true || (
     value.success === undefined && value.ok === undefined && !value.error
   );
 };
 
-const rtlRetryableEnvelopeError = (value) => {
-  const error = value?.error && typeof value.error === 'object' ? value.error : value;
-  const status = Number(error?.status ?? error?.statusCode ?? value?.status ?? value?.statusCode);
-  const details = [
-    error?.name,
-    error?.code,
-    error?.reason,
-    error?.message,
-    value?.code,
-    value?.reason,
-    value?.message
-  ].filter(Boolean).join(' ').toLowerCase();
-  return Boolean(
-    error?.retryable === true ||
-    value?.retryable === true ||
-    status === 408 || status === 409 || status === 425 || status === 429 || status >= 500 ||
-    details.includes('bulk_job_in_progress') || details.includes('retryable') ||
-    details.includes('temporarily_unavailable') || details.includes('unavailable') ||
-    details.includes('deadline_exceeded') || details.includes('failed to fetch') ||
-    details.includes('fetch failed') || details.includes('network-request-failed') ||
-    details.includes('network request failed') || details.includes('network_error') ||
-    details.includes('err_network') || details.includes('econnreset') ||
-    details.includes('etimedout')
-  );
+const rtlExplicitRevisionInfo = (value) => {
+  const revisions = [];
+  let invalid = false;
+  const visited = new Set();
+  const add = (source, key) => {
+    if (!source || typeof source !== 'object' ||
+        !Object.prototype.hasOwnProperty.call(source, key)) return;
+    const raw = source[key];
+    const numeric = typeof raw === 'number' ||
+      (typeof raw === 'string' && raw.trim() !== '')
+      ? Number(raw)
+      : NaN;
+    if (!Number.isSafeInteger(numeric) || numeric < 0) {
+      invalid = true;
+      return;
+    }
+    revisions.push(numeric);
+  };
+  const visit = (source, depth = 0) => {
+    if (!source || typeof source !== 'object' || visited.has(source) || depth > 8) return;
+    visited.add(source);
+    add(source, 'revision');
+    add(source, 'remoteRevision');
+    [
+      source.remoteBaseline,
+      source.baseline,
+      source.snapshot,
+      source.failure,
+      source.error
+    ].forEach((nested) => visit(nested, depth + 1));
+  };
+  visit(value);
+  const unique = [...new Set(revisions)];
+  if (unique.length > 1) invalid = true;
+  return {
+    present: revisions.length > 0 || invalid,
+    valid: !invalid,
+    revision: unique[0] ?? null
+  };
 };
 
-const rtlRetryAfterMs = (value) => {
-  const error = value?.error && typeof value.error === 'object' ? value.error : value;
-  const rawRetryAfter = error?.retryAfterMs ?? value?.retryAfterMs;
-  if (rawRetryAfter === null || rawRetryAfter === undefined || rawRetryAfter === '') return null;
-  const retryAfter = Number(rawRetryAfter);
-  return Number.isFinite(retryAfter) && retryAfter >= 0 ? retryAfter : null;
+const rtlInvalidRevisionError = () => {
+  const error = new Error('sync_protocol_invalid_revision');
+  error.code = 'sync_protocol_invalid_revision';
+  return error;
 };
 
 const rtlResultOperationId = (result = {}) => normalizeId(
@@ -3569,6 +3947,12 @@ export const createRecordTimeLabelSyncEngine = ({
 
   const capture = () => rtlExtractSession(session, workspace.workspaceEpoch);
 
+  const workspaceMatchesSession = (captured) => {
+    if (!captured?.hasSession) return true;
+    return rtlNormalizeUid(workspace.ownerUid) === captured.uid &&
+      Number(workspace.workspaceEpoch) === Number(captured.workspaceEpoch);
+  };
+
   const isCurrent = async (captured) => {
     if (destroyed || !captured) return false;
     if (typeof session?.isCurrent === 'function') {
@@ -3595,11 +3979,23 @@ export const createRecordTimeLabelSyncEngine = ({
 
   const persist = async (candidate, captured) => {
     if (!(await isCurrent(captured))) return false;
+    const cursor = candidate?.remoteBaseline?.changeCursor;
+    if (cursor !== null && cursor !== undefined) {
+      const durableCursor = rtlDurableIsObject(cursor) ? clone(cursor) : {value: String(cursor)};
+      candidate.remoteBaseline.changeCursor = {
+        ...durableCursor,
+        ownerUid: captured?.uid ?? null,
+        uid: captured?.uid ?? null,
+        workspaceEpoch: captured?.workspaceEpoch ?? candidate.workspaceEpoch,
+        authSessionBinding: captured?.authSessionBinding ?? null
+      };
+    }
+    const durableCandidate = rtlStripSessionTokens(candidate);
     // The second argument is an optional adapter-side fence.  The public
     // StoragePort remains compatible with save(workspace); adapters that can
     // enforce an atomic session/epoch check should consume this context before
     // mutating durable storage.
-    await storage.save(clone(candidate), {
+    await storage.save(clone(durableCandidate), {
       sessionToken: captured?.sessionToken ?? null,
       uid: captured?.uid ?? null,
       ownerUid: captured?.uid ?? null,
@@ -3618,7 +4014,9 @@ export const createRecordTimeLabelSyncEngine = ({
     }
     const nextBaseline = rtlNormalizeRemoteBaseline({
       state: remote.state ?? remote.data ?? candidate.remoteBaseline.state,
-      revision: Number.isFinite(revision) ? revision : candidate.remoteBaseline.revision,
+      revision: Number.isSafeInteger(revision) && revision >= 0
+        ? revision
+        : candidate.remoteBaseline.revision,
       changeCursor: Object.prototype.hasOwnProperty.call(remote, 'changeCursor')
         ? remote.changeCursor
         : candidate.remoteBaseline.changeCursor
@@ -3638,18 +4036,18 @@ export const createRecordTimeLabelSyncEngine = ({
 
   const normalizeBootstrapResponse = (response) => {
     if (!rtlEnvelopeSuccess(response)) {
-      throw toRecordTimeLabelCloudFailureError({
-        ...((response && typeof response === 'object') ? response : {}),
-        message: response?.error?.message || response?.message || 'recordtimelabel_bootstrap_failed',
-        code: response?.error?.code || response?.code || 'recordtimelabel_bootstrap_failed',
-        reason: response?.error?.reason || response?.reason ||
-          response?.error?.code || response?.code || 'recordtimelabel_bootstrap_failed'
-      });
+      const source = response && typeof response === 'object' ? response : {
+        message: 'recordtimelabel_bootstrap_failed',
+        code: 'recordtimelabel_bootstrap_failed',
+        reason: 'recordtimelabel_bootstrap_failed'
+      };
+      throw toRecordTimeLabelCloudFailureError(source);
     }
     const remote = rtlEnvelopePayload(response);
     const revision = Number(remote?.revision);
     const state = remote?.state ?? remote?.data;
-    if (!remote || !rtlDurableIsObject(state) || !Number.isFinite(revision) || revision < 0) {
+    if (!remote || !rtlDurableIsObject(state) ||
+      !Number.isSafeInteger(revision) || revision < 0) {
       throw toRecordTimeLabelCloudFailureError({
         code: 'recordtimelabel_invalid_bootstrap_response',
         reason: 'recordtimelabel_invalid_bootstrap_response',
@@ -3703,7 +4101,7 @@ export const createRecordTimeLabelSyncEngine = ({
   const rethrowClassifiedCloudFailure = (captured, error) => {
     const failure = normalizeRecordTimeLabelCloudFailure(error);
     rememberAuthTransitionFailure(captured, failure);
-    if (error?.class === failure.class) throw error;
+    if (error instanceof Error && error?.class === failure.class) throw error;
     throw toRecordTimeLabelCloudFailureError(failure);
   };
 
@@ -3714,6 +4112,12 @@ export const createRecordTimeLabelSyncEngine = ({
       error.code = 'recordtimelabel_bootstrap_revision_behind_required';
       error.bootstrapRevision = Number(baseline?.revision);
       error.minimumRevision = minimum;
+      error.failure = normalizeRecordTimeLabelCloudFailure({
+        class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.BOOTSTRAP_REQUIRED,
+        code: error.code,
+        reason: error.code,
+        message: error.message
+      });
       throw error;
     }
     return baseline;
@@ -3939,13 +4343,366 @@ export const createRecordTimeLabelSyncEngine = ({
     nextRetryAt: operationRetryAt(operation, result, retryAfterMs, timestamp)
   });
 
+  const failureOutcome = (failure, error, extra = {}) => ({
+    success: false,
+    failure: clone(failure),
+    error,
+    class: failure.class,
+    status: failure.status,
+    code: failure.code,
+    reason: failure.reason,
+    retryable: failure.retryable,
+    retryAfterMs: failure.retryAfterMs,
+    bootstrapRequired: failure.bootstrapRequired,
+    pendingCount: workspace.pendingOperations.length,
+    ...extra
+  });
+
+  const persistTerminalFailureBlock = async ({
+    failure,
+    error,
+    captured,
+    timestamp,
+    identityRejectedCount,
+    extra = {}
+  }) => {
+    const candidate = clone(workspace);
+    candidate.syncMeta = {
+      ...candidate.syncMeta,
+      lastSyncAttemptAt: timestamp,
+      lastSyncError: failure.message || failure.code || 'terminal',
+      lastSyncFailure: clone(failure),
+      terminalFailureBlock: clone(failure)
+    };
+    if (!(await persist(candidate, captured))) return {success: false, reason: 'stale_session'};
+    workspace = candidate;
+    return failureOutcome(failure, error, {
+      protocolError: true,
+      blocked: true,
+      identityRejectedCount,
+      ...extra
+    });
+  };
+
+  const rebaseAfterBootstrapRequired = async ({
+    failure,
+    error,
+    captured,
+    context,
+    timestamp,
+    identityRejectedCount
+  }) => {
+    hydrationRequired = true;
+    if (typeof cloud?.bootstrap !== 'function') {
+      return failureOutcome(failure, error, {
+        bootstrapRequired: true,
+        hydrationBarrier: true,
+        identityRejectedCount
+      });
+    }
+    let baseline;
+    try {
+      baseline = normalizeBootstrapResponse(await cloud.bootstrap(
+        context,
+        bootstrapAttemptOptions('apply-failure-rebase')
+      ));
+    } catch (bootstrapError) {
+      if (!(await isCurrent(captured))) return {success: false, reason: 'stale_session'};
+      rethrowClassifiedCloudFailure(captured, bootstrapError);
+    }
+    if (!(await isCurrent(captured))) return {success: false, reason: 'stale_session'};
+    const candidate = clone(workspace);
+    const applied = applyRemoteBaseline(candidate, baseline);
+    if (applied.stale) {
+      const staleFailure = normalizeRecordTimeLabelCloudFailure({
+        class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.BOOTSTRAP_REQUIRED,
+        code: 'bootstrap_revision_behind_required',
+        reason: 'bootstrap_revision_behind_required',
+        message: 'bootstrap_revision_behind_required'
+      });
+      return failureOutcome(staleFailure, toRecordTimeLabelCloudFailureError(staleFailure), {
+        bootstrapRequired: true,
+        hydrationBarrier: true,
+        identityRejectedCount
+      });
+    }
+    candidate.syncMeta = {...candidate.syncMeta};
+    delete candidate.syncMeta.terminalFailureBlock;
+    candidate.syncMeta.lastSyncFailure = clone(failure);
+    candidate.syncMeta.lastSyncAttemptAt = timestamp;
+    candidate.syncMeta.lastSyncError = null;
+    if (!(await persist(candidate, captured))) return {success: false, reason: 'stale_session'};
+    workspace = candidate;
+    hydrationRequired = false;
+    notify({type: 'hydration_rebased', failure: clone(failure)});
+    return failureOutcome(failure, error, {
+      bootstrapRequired: true,
+      hydrationBarrier: false,
+      rebaseCompleted: true,
+      identityRejectedCount
+    });
+  };
+
+  const isAuthoritativeFailureBaseline = (value, minimumRevision, verifiedRevision = null) => {
+    const remote = rtlEnvelopePayload(value);
+    const revision = Number(remote?.revision ?? remote?.remoteRevision);
+    const minimum = Number(minimumRevision);
+    const verified = Number(verifiedRevision);
+    return Boolean(
+      remote &&
+      rtlDurableIsObject(remote.state ?? remote.data) &&
+      Number.isSafeInteger(revision) &&
+      revision >= (Number.isFinite(minimum) ? minimum : 0) &&
+      (verifiedRevision === null || verifiedRevision === undefined ||
+        (Number.isSafeInteger(verified) && revision === verified))
+    );
+  };
+
+  const settleApplyFailure = async ({
+    value,
+    captured,
+    context,
+    ready,
+    timestamp,
+    identityRejectedCount
+  }) => {
+    const failure = normalizeRecordTimeLabelCloudFailure(value);
+    const error = toRecordTimeLabelCloudFailureError(failure);
+    const responseRevisionInfo = rtlExplicitRevisionInfo(value);
+
+    if (failure.class === RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.STALE_SESSION) {
+      // A stale response is never an acknowledgement for the captured
+      // workspace.  In particular, do not persist retry metadata or notify
+      // listeners that may already be observing a newer session.
+      return failureOutcome(failure, error, {
+        stale: true,
+        reason: 'stale_session',
+        identityRejectedCount
+      });
+    }
+
+    if (failure.class === RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.AUTH_TRANSITION_REQUIRED) {
+      rememberAuthTransitionFailure(captured, failure);
+      throw error;
+    }
+
+    if (failure.class === RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.BOOTSTRAP_REQUIRED) {
+      return rebaseAfterBootstrapRequired({
+        failure,
+        error,
+        captured,
+        context,
+        timestamp,
+        identityRejectedCount
+      });
+    }
+
+    if (failure.class === RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.TRANSIENT) {
+      const candidate = clone(workspace);
+      const readyIds = new Set(ready.map((operation) => operation.id));
+      candidate.pendingOperations = candidate.pendingOperations.map((operation) => (
+        readyIds.has(operation.id)
+          ? makeRetryOperation(operation, failure, failure.retryAfterMs, timestamp)
+          : operation
+      ));
+      candidate.syncMeta = {
+        ...candidate.syncMeta,
+        lastSyncAttemptAt: timestamp,
+        lastSyncError: failure.message || failure.reason || failure.code || 'retryable',
+        lastSyncFailure: clone(failure)
+      };
+      if (!(await persist(candidate, captured))) return {success: false, reason: 'stale_session'};
+      workspace = candidate;
+      notify({
+        type: 'sync_retry',
+        reason: failure.code || failure.reason || 'retryable',
+        failure: clone(failure)
+      });
+      const retryAt = Math.min(...candidate.pendingOperations
+        .filter((operation) => Number.isFinite(Number(operation.nextRetryAt)))
+        .map((operation) => Number(operation.nextRetryAt)));
+      return failureOutcome(failure, error, {
+        retryable: true,
+        retryAfterMs: failure.retryAfterMs,
+        retryAt: Number.isFinite(retryAt) ? retryAt : null,
+        pendingCount: workspace.pendingOperations.length,
+        identityRejectedCount
+      });
+    }
+
+    // Only an explicit request/operation-id conflict is eligible for the
+    // existing rejection-rebase path.  A bulk operation is deliberately
+    // excluded: quarantining one entry from a bulk job would acknowledge a
+    // request whose server-side transaction did not run.
+    const isBulkBatch = ready.some((operation) => (
+      typeof RTL_BULK_OPERATION_TYPES !== 'undefined' &&
+      RTL_BULK_OPERATION_TYPES.has(operation?.type)
+    ));
+    const isOperationConflict = isRecordTimeLabelOperationConflictFailure(value);
+    if (
+      failure.class === RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.TERMINAL &&
+      isOperationConflict &&
+      !isBulkBatch
+    ) {
+      // A conflict rebase is only safe when every revision alias in the
+      // response agrees.  Reject malformed/conflicting revision metadata
+      // before calling bootstrap or changing the ready outbox.
+      if (!responseRevisionInfo.valid) {
+        const protocolError = rtlInvalidRevisionError();
+        logger?.error?.('[RecordTimeLabelCore] durable sync protocol error', protocolError);
+        return persistTerminalFailureBlock({
+          failure,
+          error: protocolError,
+          captured,
+          timestamp,
+          identityRejectedCount,
+          extra: {protocolError: true}
+        });
+      }
+      let freshBaseline = null;
+      const currentRevisionValue = Number(workspace.remoteBaseline.revision);
+      const currentRevision = Number.isSafeInteger(currentRevisionValue) && currentRevisionValue >= 0
+        ? currentRevisionValue
+        : 0;
+      const requiredRevision = Math.max(
+        currentRevision,
+        responseRevisionInfo.revision ?? 0
+      );
+      if (typeof cloud?.bootstrap === 'function') {
+        try {
+          freshBaseline = requireBootstrapRevision(
+            normalizeBootstrapResponse(await cloud.bootstrap(
+              context,
+              bootstrapAttemptOptions('rejection-rebase')
+            )),
+            requiredRevision
+          );
+        } catch (bootstrapError) {
+          if (!(await isCurrent(captured))) return {success: false, reason: 'stale_session'};
+          rethrowClassifiedCloudFailure(captured, bootstrapError);
+        }
+        if (!(await isCurrent(captured))) return {success: false, reason: 'stale_session'};
+      } else if (isAuthoritativeFailureBaseline(
+        value,
+        requiredRevision,
+        responseRevisionInfo.revision
+      )) {
+        freshBaseline = rtlEnvelopePayload(value);
+      }
+
+      // Preserve 1A1's fail-closed contract when no fresh/authoritative
+      // baseline is available: nothing, including outbox metadata, changes.
+      if (!freshBaseline) {
+        return persistTerminalFailureBlock({
+          failure,
+          error,
+          captured,
+          timestamp,
+          identityRejectedCount
+        });
+      }
+
+      const candidate = clone(workspace);
+      applyRemoteBaseline(candidate, freshBaseline);
+      const readyIds = new Set(ready.map((operation) => operation.id));
+      const rejectionResponse = rtlStripSessionTokens({
+        ...((value && typeof value === 'object') ? value : {}),
+        failure: clone(failure)
+      });
+      const nextRejected = {...candidate.rejectedOperations};
+      const rejectedResults = [];
+      const completedOperations = [];
+      ready.forEach((operation) => {
+        const reason = failure.reason || failure.code || 'operation_id_conflict';
+        nextRejected[operation.id] = {
+          id: operation.id,
+          operation: clone(operation),
+          status: 'rejected',
+          reason,
+          rejectedAt: timestamp,
+          response: rejectionResponse
+        };
+        rejectedResults.push({
+          id: operation.id,
+          operationId: operation.id,
+          status: 'rejected',
+          applied: false,
+          reason,
+          code: failure.code,
+          class: failure.class,
+          statusCode: failure.status
+        });
+        completedOperations.push({operation, status: 'rejected'});
+      });
+      candidate.pendingOperations = candidate.pendingOperations.filter((operation) => (
+        !readyIds.has(operation.id)
+      ));
+      candidate.rejectedOperations = nextRejected;
+      candidate.syncMeta = {
+        ...candidate.syncMeta,
+        lastSyncedAt: timestamp,
+        lastSyncAttemptAt: timestamp,
+        lastSyncError: null,
+        lastSyncFailure: clone(failure),
+        lastAcknowledgedRevision: Math.max(
+          rtlToFiniteNumber(candidate.syncMeta?.lastAcknowledgedRevision, 0),
+          Number(candidate.remoteBaseline.revision)
+        )
+      };
+      rtlRememberCompletedOperations(candidate, completedOperations, timestamp);
+      if (!(await persist(candidate, captured))) return {success: false, reason: 'stale_session'};
+      workspace = candidate;
+      notify({
+        type: 'synced',
+        operations: clone(rejectedResults),
+        failure: clone(failure)
+      });
+      return {
+        success: true,
+        failure: clone(failure),
+        error,
+        class: failure.class,
+        status: failure.status,
+        code: failure.code,
+        rejectedCount: ready.length,
+        syncedCount: 0,
+        pendingCount: workspace.pendingOperations.length,
+        identityRejectedCount
+      };
+    }
+
+    // Generic terminal failures are diagnostics only.  In particular, do
+    // not remove an entire ready batch merely because an old gateway returned
+    // a non-retryable envelope. Block the FIFO explicitly so callers cannot
+    // accidentally resend an unlocatable terminal batch forever.
+    logger?.error?.('[RecordTimeLabelCore] durable sync envelope failed', error);
+    return persistTerminalFailureBlock({
+      failure,
+      error,
+      captured,
+      timestamp,
+      identityRejectedCount
+    });
+  };
+
   const processRemote = async (remoteValue, captured) => {
     if (!(await isCurrent(captured))) return {stale: true, reason: 'stale_session'};
     const candidate = clone(workspace);
     const remote = rtlEnvelopePayload(remoteValue);
     const remoteRevision = Number(remote?.revision);
-    if (!Number.isFinite(remoteRevision)) {
-      return {success: false, protocolError: true, reason: 'invalid_remote_revision'};
+    if (!Number.isSafeInteger(remoteRevision) || remoteRevision < 0) {
+      const failure = normalizeRecordTimeLabelCloudFailure({
+        class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.TERMINAL,
+        code: 'invalid_remote_revision',
+        reason: 'invalid_remote_revision',
+        message: 'invalid_remote_revision'
+      });
+      return {
+        success: false,
+        protocolError: true,
+        reason: 'invalid_remote_revision',
+        failure
+      };
     }
     if (remoteRevision <= candidate.remoteBaseline.revision) {
       return {success: true, ignored: true};
@@ -3955,7 +4712,19 @@ export const createRecordTimeLabelSyncEngine = ({
     const revisionOnlyNotification = !rtlDurableIsObject(remoteState);
     if (remoteRevision > candidate.remoteBaseline.revision + 1 || revisionOnlyNotification) {
       if (typeof cloud?.bootstrap !== 'function') {
-        return {success: false, reason: 'revision_gap', bootstrapRequired: true};
+        const failure = normalizeRecordTimeLabelCloudFailure({
+          class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.BOOTSTRAP_REQUIRED,
+          code: 'revision_gap',
+          reason: 'revision_gap',
+          message: 'revision_gap'
+        });
+        return {
+          success: false,
+          reason: 'revision_gap',
+          bootstrapRequired: true,
+          failure,
+          error: toRecordTimeLabelCloudFailureError(failure)
+        };
       }
       const context = rtlSessionContext(captured, candidate, client);
       baselineValue = await recoverBaseline(context, remoteRevision, 'gap-recovery');
@@ -3985,14 +4754,37 @@ export const createRecordTimeLabelSyncEngine = ({
         state.settled = true;
         resolvePromise({
           success: true,
-          ...(value && typeof value === 'object' ? value : {}),
-          generation
+          ...(value && typeof value === 'object' ? value : {})
         });
       },
       reject(error) {
         if (state.settled) return;
         state.settled = true;
-        rejectPromise(error);
+        const failure = normalizeRecordTimeLabelCloudFailure(error);
+        let canonicalError = error;
+        if (error instanceof Error) {
+          Object.assign(error, {
+            schemaVersion: failure.schemaVersion,
+            class: failure.class,
+            code: failure.code,
+            reason: failure.reason,
+            status: failure.status,
+            retryable: failure.retryable,
+            retryAfterMs: failure.retryAfterMs,
+            bootstrapRequired: failure.bootstrapRequired,
+            requestId: failure.requestId
+          });
+          if (!error.failure) {
+            Object.defineProperty(error, 'failure', {
+              value: failure,
+              enumerable: false,
+              configurable: true
+            });
+          }
+        } else {
+          canonicalError = toRecordTimeLabelCloudFailureError(failure);
+        }
+        rejectPromise(canonicalError);
       }
     };
     // Readiness is an opt-in host boundary. Keep a rejection observable to a
@@ -4004,7 +4796,12 @@ export const createRecordTimeLabelSyncEngine = ({
 
   const staleRemoteReady = (state, reason = 'stale_session') => {
     if (!state || state.settled) return;
-    state.resolve({success: false, stale: true, reason});
+    const failure = normalizeRecordTimeLabelCloudFailure({
+      class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.STALE_SESSION,
+      code: reason,
+      reason
+    });
+    state.resolve({success: false, stale: true, reason, failure});
   };
 
   const isCurrentRemoteReady = (state) => (
@@ -4022,6 +4819,17 @@ export const createRecordTimeLabelSyncEngine = ({
     if (settleReady) staleRemoteReady(remoteReadyState);
   };
 
+  const resetForSessionIdentity = (captured) => {
+    stopCloudSubscription();
+    workspace = rtlEmptyDurableWorkspace({
+      ownerUid: captured?.uid,
+      workspaceEpoch: captured?.workspaceEpoch
+    });
+    initialized = false;
+    hydrationRequired = true;
+    notify({type: 'session_changed'});
+  };
+
   const startCloudSubscription = (captured, candidate) => {
     stopCloudSubscription();
     const readyState = createRemoteReadyState();
@@ -4035,7 +4843,12 @@ export const createRecordTimeLabelSyncEngine = ({
       return;
     }
     if (typeof cloud?.subscribe !== 'function') {
-      readyState.resolve({skipped: true, reason: 'no_subscription'});
+      readyState.reject(toRecordTimeLabelCloudFailureError({
+        class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.TERMINAL,
+        code: 'remote_provider_missing',
+        reason: 'remote_provider_missing',
+        message: 'remote_provider_missing'
+      }));
       return;
     }
     const context = rtlSessionContext(captured, candidate, client);
@@ -4043,24 +4856,64 @@ export const createRecordTimeLabelSyncEngine = ({
     let subscriptionReturned = false;
     let adapterReadyExpected = false;
     let firstCallbackResult = null;
+    let firstRootObservation = null;
+    let adapterCatchUpProof = null;
+    const settleReadyIfProven = () => {
+      if (!isCurrentRemoteReady(readyState) || readyState.settled ||
+        !firstRootObservation || (adapterReadyExpected && !adapterCatchUpProof)) {
+        return;
+      }
+      const baselineRevision = Number.isSafeInteger(workspace.remoteBaseline.revision)
+        ? workspace.remoteBaseline.revision
+        : 0;
+      const proof = adapterCatchUpProof || {};
+      const revision = Number.isSafeInteger(Number(proof.revision))
+        ? Number(proof.revision)
+        : baselineRevision;
+      const caughtUpToRevision = Number.isSafeInteger(Number(proof.caughtUpToRevision))
+        ? Number(proof.caughtUpToRevision)
+        : revision;
+      readyState.resolve({
+        sessionKey: proof.sessionKey ??
+          context.sessionKey ??
+          captured.sessionToken ??
+          captured.uid ??
+          null,
+        revision,
+        caughtUpToRevision
+      });
+    };
+    const handleRootObservation = async (result) => {
+      if (!(await isCurrent(captured)) || !isCurrentRemoteReady(readyState)) return;
+      if (result?.stale === true || result?.reason === 'stale_session') return;
+      if (result?.success === false) {
+        readyState.reject(toRecordTimeLabelCloudFailureError(
+          result.failure || {
+            class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.TERMINAL,
+            code: result.reason || 'remote_initial_observation_failed',
+            reason: result.reason || 'remote_initial_observation_failed'
+          }
+        ));
+        return;
+      }
+      firstRootObservation = result || {success: true};
+      if (!adapterReadyExpected) {
+        adapterCatchUpProof = {
+          success: true,
+          sessionKey: captured.sessionToken ?? captured.uid ?? null,
+          revision: workspace.remoteBaseline.revision,
+          caughtUpToRevision: workspace.remoteBaseline.revision
+        };
+      }
+      settleReadyIfProven();
+    };
     const onRemote = (remoteValue) => {
       if (destroyed || !isCurrentRemoteReady(readyState)) {
         return Promise.resolve({success: false, stale: true, reason: 'stale_session'});
       }
       const callbackResult = enqueue(() => processRemote(remoteValue, captured));
       if (!firstCallbackResult) firstCallbackResult = callbackResult;
-      callbackResult.then((result) => {
-        if (
-          subscriptionReturned &&
-          !adapterReadyExpected &&
-          isCurrentRemoteReady(readyState)
-        ) {
-          readyState.resolve({
-            revision: workspace.remoteBaseline.revision,
-            result
-          });
-        }
-      }).catch((error) => {
+      callbackResult.then((result) => handleRootObservation(result)).catch((error) => {
         if (isCurrentRemoteReady(readyState) && !readyState.settled) {
           readyState.reject(error);
         }
@@ -4076,29 +4929,52 @@ export const createRecordTimeLabelSyncEngine = ({
       logger?.error?.('[RecordTimeLabelCore] durable subscribe failed', error);
       return;
     }
-    unsubscribeCloud = typeof disposer === 'function' ? disposer : null;
+    unsubscribeCloud = typeof disposer === 'function'
+      ? disposer
+      : (typeof disposer?.unsubscribe === 'function' ? disposer.unsubscribe : null);
+    const onSubscriptionError = (error) => {
+      if (!isCurrentRemoteReady(readyState)) return;
+      stopCloudSubscription({settleReady: false});
+      const failure = normalizeRecordTimeLabelCloudFailure(error);
+      readyState.reject(toRecordTimeLabelCloudFailureError(failure));
+      notify({type: 'remote_error', failure: clone(failure)});
+    };
+    try {
+      if (typeof disposer?.setErrorHandler === 'function') {
+        disposer.setErrorHandler(onSubscriptionError);
+      } else if (typeof disposer?.onError === 'function') {
+        disposer.onError(onSubscriptionError);
+      }
+    } catch (error) {
+      onSubscriptionError(error);
+      return;
+    }
     adapterReadyExpected = Boolean(disposer?.ready && typeof disposer.ready.then === 'function');
     subscriptionReturned = true;
     if (adapterReadyExpected) {
       Promise.resolve(disposer.ready).then((result) => {
         if (!isCurrentRemoteReady(readyState)) return;
-        readyState.resolve({
-          revision: workspace.remoteBaseline.revision,
-          result
-        });
+        if (result?.success === false) {
+          readyState.reject(toRecordTimeLabelCloudFailureError(
+            result.failure || {
+              class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.TERMINAL,
+              code: result.reason || 'remote_initial_observation_failed',
+              reason: result.reason || 'remote_initial_observation_failed'
+            }
+          ));
+        } else {
+          adapterCatchUpProof = result && typeof result === 'object'
+            ? {...result, success: true}
+            : {success: true};
+          settleReadyIfProven();
+        }
       }).catch((error) => {
         if (isCurrentRemoteReady(readyState) && !readyState.settled) {
           readyState.reject(error);
         }
       });
     } else if (firstCallbackResult) {
-      firstCallbackResult.then((result) => {
-        if (!isCurrentRemoteReady(readyState)) return;
-        readyState.resolve({
-          revision: workspace.remoteBaseline.revision,
-          result
-        });
-      }).catch(() => null);
+      firstCallbackResult.then(() => settleReadyIfProven()).catch(() => null);
     }
   };
 
@@ -4114,10 +4990,7 @@ export const createRecordTimeLabelSyncEngine = ({
     const loadedOwnerUid = rtlNormalizeUid(loaded?.ownerUid);
     const loadedBaseline = loaded?.remoteBaseline;
     const committedRevision = Number(loadedBaseline?.revision);
-    const hasValidCommittedBaseline = rtlDurableIsObject(loadedBaseline) &&
-      rtlDurableIsObject(loadedBaseline.state) &&
-      Number.isFinite(committedRevision) &&
-      committedRevision > 0;
+    const hasValidCommittedBaseline = rtlHasValidRawCommittedWorkspace(loaded, captured);
     let candidate = normalizeLoadedWorkspace(loaded, captured);
     const identityChecked = rtlQuarantineOperations(
       candidate,
@@ -4135,6 +5008,13 @@ export const createRecordTimeLabelSyncEngine = ({
       candidate.remoteBaseline.revision === committedRevision &&
       (!captured.hasEpoch || Number(candidate.workspaceEpoch) === Number(captured.workspaceEpoch));
     if (captured?.uid && typeof cloud?.bootstrap === 'function' && !canReuseCommitted) {
+      // Do not carry untrusted resume state into a fresh hydration attempt.
+      // Only the bootstrap response may establish the next cursor/marker.
+      candidate.remoteBaseline.changeCursor = null;
+      candidate.syncMeta = {...candidate.syncMeta};
+      ['resumeMarker', 'resume', 'bootstrapMarker', 'authSessionBinding'].forEach((key) => {
+        delete candidate.syncMeta[key];
+      });
       let bootstrap;
       try {
         bootstrap = normalizeBootstrapResponse(await cloud.bootstrap(
@@ -4147,6 +5027,7 @@ export const createRecordTimeLabelSyncEngine = ({
       }
       if (!(await isCurrent(captured))) return getSnapshot();
       applyRemoteBaseline(candidate, bootstrap);
+      delete candidate.syncMeta.terminalFailureBlock;
     }
 
     // Always persist the normalized durable shape before subscribing.  This
@@ -4191,7 +5072,12 @@ export const createRecordTimeLabelSyncEngine = ({
       return {success: false, code: 'recordtimelabel_hydration_required'};
     }
     const captured = capture();
+    clearAuthTransitionLatchIfSessionChanged(captured);
     if (!(await isCurrent(captured))) return getSnapshot();
+    if (!workspaceMatchesSession(captured)) {
+      resetForSessionIdentity(captured);
+      return {success: false, code: 'recordtimelabel_hydration_required'};
+    }
     const input = Array.isArray(operations)
       ? operations
       : (operations && typeof operations === 'object' ? [operations] : []);
@@ -4272,11 +5158,25 @@ export const createRecordTimeLabelSyncEngine = ({
   };
 
   const syncInternal = async (reason) => {
+    const captured = capture();
+    throwIfAuthTransitionLatched(captured);
     if (!initialized || hydrationRequired) {
       return {success: false, code: 'recordtimelabel_hydration_required'};
     }
-    const captured = capture();
     if (!(await isCurrent(captured))) return {success: false, reason: 'stale_session'};
+    if (!workspaceMatchesSession(captured)) {
+      resetForSessionIdentity(captured);
+      return {success: false, code: 'recordtimelabel_hydration_required'};
+    }
+    const blockedFailure = workspace.syncMeta?.terminalFailureBlock;
+    if (blockedFailure) {
+      const failure = normalizeRecordTimeLabelCloudFailure(blockedFailure);
+      return failureOutcome(
+        failure,
+        toRecordTimeLabelCloudFailureError(failure),
+        {protocolError: true, blocked: true, identityRejectedCount: 0}
+      );
+    }
     const timestamp = now();
     const identityChecked = rtlQuarantineOperations(
       workspace,
@@ -4328,7 +5228,22 @@ export const createRecordTimeLabelSyncEngine = ({
       };
     }
     if (typeof cloud?.applyOperations !== 'function') {
-      return {success: false, reason: 'missing_cloud_apply_operations'};
+      const failure = normalizeRecordTimeLabelCloudFailure({
+        class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.TERMINAL,
+        code: 'missing_cloud_apply_operations',
+        reason: 'missing_cloud_apply_operations',
+        message: 'missing_cloud_apply_operations'
+      });
+      return {
+        success: false,
+        failure,
+        error: toRecordTimeLabelCloudFailureError(failure),
+        class: failure.class,
+        code: failure.code,
+        reason: failure.reason,
+        pendingCount: workspace.pendingOperations.length,
+        identityRejectedCount
+      };
     }
     const context = rtlSessionContext(captured, workspace, client);
     const wireOperations = ready.map((operation) => toRecordTimeLabelWireOperation(operation));
@@ -4350,59 +5265,79 @@ export const createRecordTimeLabelSyncEngine = ({
       }, context);
     } catch (error) {
       if (!(await isCurrent(captured))) return {success: false, reason: 'stale_session'};
-      if (!rtlRetryableEnvelopeError(error)) {
-        logger?.error?.('[RecordTimeLabelCore] durable sync failed', error);
-        return {success: false, error};
-      }
-      response = {
-        success: false,
-        error,
-        retryAfterMs: rtlRetryAfterMs(error)
-      };
+      return settleApplyFailure({
+        value: error,
+        captured,
+        context,
+        ready,
+        timestamp,
+        identityRejectedCount
+      });
     }
     if (!(await isCurrent(captured))) return {success: false, reason: 'stale_session'};
 
-    if (!rtlEnvelopeSuccess(response)) {
-      if (!rtlRetryableEnvelopeError(response)) {
-        const error = response?.error instanceof Error
-          ? response.error
-          : new Error(response?.error?.message || response?.message || response?.code || 'sync_envelope_failed');
-        logger?.error?.('[RecordTimeLabelCore] durable sync envelope failed', error);
-        return {success: false, error};
+    const hasCanonicalFailure = Boolean(
+      response &&
+      typeof response === 'object' &&
+      Object.prototype.hasOwnProperty.call(response, 'failure') &&
+      response.failure != null
+    );
+    if (hasCanonicalFailure || !rtlEnvelopeSuccess(response)) {
+      // An explicit operationResults array remains a supported legacy
+      // response shape, but a canonical `failure` is authoritative even if a
+      // gateway accidentally includes an empty/partial result array beside it.
+      if (hasCanonicalFailure || !Object.prototype.hasOwnProperty.call(response || {}, 'operationResults')) {
+        return settleApplyFailure({
+          value: response,
+          captured,
+          context,
+          ready,
+          timestamp,
+          identityRejectedCount
+        });
       }
-      const retryAfterMs = rtlRetryAfterMs(response);
-      const candidate = clone(workspace);
-      const byId = new Set(ready.map((operation) => operation.id));
-      candidate.pendingOperations = candidate.pendingOperations.map((operation) => (
-        byId.has(operation.id)
-          ? makeRetryOperation(operation, response, retryAfterMs, timestamp)
-          : operation
-      ));
-      candidate.syncMeta = {
-        ...candidate.syncMeta,
-        lastSyncAttemptAt: timestamp,
-        lastSyncError: response?.error?.message || response?.message || response?.code || 'retryable'
-      };
-      if (!(await persist(candidate, captured))) return {success: false, reason: 'stale_session'};
-      workspace = candidate;
-      notify({type: 'sync_retry', reason: response?.error?.code || response?.code || 'retryable'});
-      const retryAt = Math.min(...candidate.pendingOperations
-        .filter((operation) => Number.isFinite(Number(operation.nextRetryAt)))
-        .map((operation) => Number(operation.nextRetryAt)));
-      return {
-        success: false,
-        retryable: true,
-        retryAfterMs,
-        retryAt: Number.isFinite(retryAt) ? retryAt : null,
-        pendingCount: workspace.pendingOperations.length,
-        identityRejectedCount
-      };
     }
 
+    const responseRevisionInfo = rtlExplicitRevisionInfo(response);
+    if (!responseRevisionInfo.valid) {
+      const protocolError = rtlInvalidRevisionError();
+      const failure = normalizeRecordTimeLabelCloudFailure({
+        class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.TERMINAL,
+        code: protocolError.code,
+        reason: protocolError.code,
+        message: protocolError.message
+      });
+      const error = toRecordTimeLabelCloudFailureError(failure);
+      logger?.error?.('[RecordTimeLabelCore] durable sync protocol error', error);
+      return persistTerminalFailureBlock({
+        failure,
+        error,
+        captured,
+        timestamp,
+        identityRejectedCount,
+        extra: {protocolError: true}
+      });
+    }
+    const responseBaseline = rtlEnvelopePayload(response);
+    const responseRevision = responseRevisionInfo.revision;
     const parsed = normalizeOperationResults(response, wireOperations);
     if (parsed.error) {
-      logger?.error?.('[RecordTimeLabelCore] durable sync protocol error', parsed.error);
-      return {success: false, error: parsed.error, protocolError: true};
+      const failure = normalizeRecordTimeLabelCloudFailure({
+        class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.TERMINAL,
+        code: parsed.error.code || 'protocol_error',
+        reason: parsed.error.reason || parsed.error.code || 'protocol_error',
+        message: parsed.error.message || parsed.error.code || 'protocol_error'
+      });
+      const error = toRecordTimeLabelCloudFailureError(failure);
+      logger?.error?.('[RecordTimeLabelCore] durable sync protocol error', error);
+      return persistTerminalFailureBlock({
+        failure,
+        error,
+        captured,
+        timestamp,
+        identityRejectedCount,
+        extra: {protocolError: true}
+      });
     }
     let sawRetryable = false;
     for (const result of parsed.results) {
@@ -4412,7 +5347,20 @@ export const createRecordTimeLabelSyncEngine = ({
         const error = new Error('sync_protocol_fifo_retry_barrier_violation');
         error.code = 'sync_protocol_fifo_retry_barrier_violation';
         logger?.error?.('[RecordTimeLabelCore] durable sync protocol error', error);
-        return {success: false, error, protocolError: true};
+        const failure = normalizeRecordTimeLabelCloudFailure({
+          class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.TERMINAL,
+          code: error.code,
+          reason: error.code,
+          message: error.message
+        });
+        return persistTerminalFailureBlock({
+          failure,
+          error,
+          captured,
+          timestamp,
+          identityRejectedCount,
+          extra: {protocolError: true}
+        });
       }
     }
     const rejectedCount = parsed.results.filter((result) => result.status === 'rejected').length;
@@ -4450,40 +5398,109 @@ export const createRecordTimeLabelSyncEngine = ({
         };
       }
     }
-    appliedOperations.forEach((operation) => {
-      candidate.remoteBaseline.state = normalizeRecordTimeLabelDomainState(
-        applyRecordTimeLabelOperation(candidate.remoteBaseline.state, operation)
-      );
-    });
-    const responseRevision = Number(response.revision ?? response.remoteRevision);
-    const responseBaseline = rtlEnvelopePayload(response);
     const responseState = responseBaseline?.state ?? responseBaseline?.data;
-    if (rtlDurableIsObject(responseState)) {
-      applyRemoteBaseline(candidate, responseBaseline);
+    const responseBaselineForApply = rtlDurableIsObject(responseBaseline) &&
+      Number.isSafeInteger(responseRevision)
+      ? {...responseBaseline, revision: responseRevision}
+      : responseBaseline;
+    const currentBaselineRevision = Number(candidate.remoteBaseline.revision);
+    const hasAllAppliedResults = parsed.results.length > 0 &&
+      parsed.results.every((result) => result.status === 'applied');
+    const responseIsStale = Number.isFinite(responseRevision) &&
+      responseRevision <= currentBaselineRevision;
+    const responseIsExactNext = Number.isFinite(responseRevision) &&
+      responseRevision === currentBaselineRevision + 1;
+    const responseIsForwardGap = Number.isFinite(responseRevision) &&
+      responseRevision > currentBaselineRevision + 1;
+
+    const hasAuthoritativeFullBaseline = !responseIsStale &&
+      rtlDurableIsObject(responseState) &&
+      Number.isSafeInteger(responseRevision) &&
+      responseRevision > currentBaselineRevision;
+    if (
+      !responseIsStale &&
+      rejectedCount > 0 &&
+      typeof cloud?.bootstrap !== 'function' &&
+      !hasAuthoritativeFullBaseline
+    ) {
+      const failure = normalizeRecordTimeLabelCloudFailure({
+        class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.BOOTSTRAP_REQUIRED,
+        code: 'recordtimelabel_bootstrap_required',
+        reason: 'recordtimelabel_bootstrap_required',
+        message: 'recordtimelabel_bootstrap_required'
+      });
+      return {
+        success: false,
+        bootstrapRequired: true,
+        failure,
+        error: toRecordTimeLabelCloudFailureError(failure),
+        pendingCount: workspace.pendingOperations.length,
+        identityRejectedCount
+      };
+    }
+
+    // A receipt replay can arrive after realtime has already promoted the
+    // authoritative state.  ACK completion is still durable, but replaying
+    // its operations would apply settings/order changes a second time.
+    let requiresAuthoritativeRecovery = (responseIsForwardGap && rejectedCount === 0) ||
+      (responseIsExactNext && !hasAllAppliedResults && rejectedCount === 0);
+    if (
+      responseIsForwardGap &&
+      rejectedCount === 0 &&
+      typeof cloud?.bootstrap !== 'function' &&
+      typeof cloud?.catchUp !== 'function'
+    ) {
+      const failure = normalizeRecordTimeLabelCloudFailure({
+        class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.BOOTSTRAP_REQUIRED,
+        code: 'recordtimelabel_bootstrap_required',
+        reason: 'recordtimelabel_bootstrap_required',
+        message: 'recordtimelabel_bootstrap_required'
+      });
+      return {
+        success: false,
+        bootstrapRequired: true,
+        failure,
+        error: toRecordTimeLabelCloudFailureError(failure),
+        pendingCount: workspace.pendingOperations.length,
+        identityRejectedCount
+      };
+    }
+    if (requiresAuthoritativeRecovery) {
+      const freshBaseline = await recoverBaseline(context, responseRevision, 'gap-recovery');
+      if (!(await isCurrent(captured))) return {success: false, reason: 'stale_session'};
+      applyRemoteBaseline(candidate, freshBaseline);
+    } else if (!responseIsStale && rtlDurableIsObject(responseState)) {
+      // A same-transaction full baseline is authoritative at the exact next
+      // revision.  Older receipt payloads are intentionally ignored above.
+      applyRemoteBaseline(candidate, responseBaselineForApply);
     } else if (
+      !responseIsStale &&
+      responseIsExactNext &&
       rejectedCount === 0 &&
       !sawRetryable &&
-      appliedOperations.length === completedOperations.length &&
-      appliedOperations.length > 0 &&
-      Number.isFinite(responseRevision) &&
-      responseRevision === candidate.remoteBaseline.revision + 1
+      hasAllAppliedResults
     ) {
-      // The v2 gateway ACK is intentionally compact and omits state. Promote
-      // only an all-applied transaction at exactly the next revision; any
-      // larger jump still needs an authoritative bootstrap baseline.
+      // The compact v2 ACK omits state. Promote only a complete all-applied
+      // transaction at exactly the next revision; a gap must be recovered.
+      candidate.remoteBaseline.state = normalizeRecordTimeLabelDomainState(
+        appliedOperations.reduce(
+          (state, operation) => applyRecordTimeLabelOperation(state, operation),
+          candidate.remoteBaseline.state
+        )
+      );
       candidate.remoteBaseline.revision = responseRevision;
       if (Object.prototype.hasOwnProperty.call(responseBaseline || {}, 'changeCursor')) {
         candidate.remoteBaseline.changeCursor = responseBaseline.changeCursor ?? null;
       }
-    } else if (
-      rejectedCount === 0 &&
-      Number.isFinite(responseRevision) &&
-      responseRevision > candidate.remoteBaseline.revision + 1 &&
-      typeof cloud?.bootstrap === 'function'
-    ) {
-      const freshBaseline = await recoverBaseline(context, responseRevision, 'gap-recovery');
-      if (!(await isCurrent(captured))) return {success: false, reason: 'stale_session'};
-      applyRemoteBaseline(candidate, freshBaseline);
+    } else if (!responseIsStale && !Number.isFinite(responseRevision)) {
+      // Legacy envelopes without a revision have no stale-receipt ordering
+      // signal. Preserve their historical local promotion compatibility.
+      candidate.remoteBaseline.state = normalizeRecordTimeLabelDomainState(
+        appliedOperations.reduce(
+          (state, operation) => applyRecordTimeLabelOperation(state, operation),
+          candidate.remoteBaseline.state
+        )
+      );
     }
     candidate.pendingOperations = nextPending;
     candidate.rejectedOperations = nextRejected;
@@ -4654,7 +5671,14 @@ export const createRecordTimeLabelSyncEngine = ({
   const engine = {
     init() {
       return enqueue(async () => {
-        if (initialized && !hydrationRequired) return getSnapshot();
+        const captured = capture();
+        clearAuthTransitionLatchIfSessionChanged(captured);
+        if (initialized && !hydrationRequired && workspaceMatchesSession(captured)) {
+          return getSnapshot();
+        }
+        if (initialized && !hydrationRequired && !workspaceMatchesSession(captured)) {
+          resetForSessionIdentity(captured);
+        }
         return initialize();
       });
     },
@@ -4677,10 +5701,16 @@ export const createRecordTimeLabelSyncEngine = ({
 
     waitForRemoteReady() {
       if (destroyed) {
+        const failure = normalizeRecordTimeLabelCloudFailure({
+          class: RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES.STALE_SESSION,
+          code: 'stale_session',
+          reason: 'stale_session'
+        });
         return Promise.resolve({
           success: false,
           stale: true,
           reason: 'stale_session',
+          failure,
           generation: remoteReadyState.generation
         });
       }
@@ -4884,20 +5914,45 @@ const RTL_BULK_OPERATION_TYPES = new Set([
 ]);
 const RTL_PROTECTED_FOLDER_IDS = new Set(['all', DEFAULT_FOLDER_ID]);
 
-const rtlByteLength = (value) => new TextEncoder().encode(String(value)).byteLength;
-const rtlOperationRecordId = (operation = {}) => normalizeId(
-  operation?.payload?.recordId || operation?.payload?.id || operation?.payload?.record?.id
-);
-const rtlOperationFolderId = (operation = {}) => normalizeId(
-  operation?.payload?.folderId || operation?.payload?.id || operation?.payload?.folder?.id
-);
-const rtlOperationTrashEntryId = (operation = {}) => normalizeId(
-  operation?.payload?.trashEntryId || operation?.payload?.id
+export const isRecordTimeLabelSafeDocumentId = rtlIsSafeDocumentId;
+const rtlOwn = (object, key) => Boolean(
+  object && Object.prototype.hasOwnProperty.call(object, key)
 );
+
+const rtlByteLength = (value) => new TextEncoder().encode(String(value)).byteLength;
+const rtlFirstPresent = (object, keys) => {
+  for (const key of keys) {
+    if (Object.prototype.hasOwnProperty.call(object || {}, key)) return object[key];
+  }
+  return undefined;
+};
+const rtlOperationRecordId = (operation = {}) => rtlFirstPresent(operation?.payload, [
+  'recordId', 'id'
+]) ?? operation?.payload?.record?.id ?? null;
+const rtlOperationFolderId = (operation = {}) => rtlFirstPresent(operation?.payload, [
+  'folderId', 'id'
+]) ?? operation?.payload?.folder?.id ?? null;
+const rtlOperationTrashEntryId = (operation = {}) => rtlFirstPresent(operation?.payload, [
+  'trashEntryId', 'id'
+]) ?? null;
 const rtlLifecycleTombstoneDocumentId = (kind, entityId) => (
   encodeURIComponent(`${kind}:${normalizeId(entityId)}`)
 );
+const rtlGetLifecycleTombstone = (documents, kind, entityId) => {
+  const logicalId = `${kind}:${normalizeId(entityId)}`;
+  const aliases = lifecycleTombstoneKeyAliases(logicalId);
+  const collection = documents?.lifecycleTombstones || {};
+  for (const alias of aliases) {
+    if (rtlOwn(collection, alias)) return collection[alias];
+  }
+  const rootField = kind === 'folder' ? 'deletedFolderTombstones' : 'deletedRecordTombstones';
+  const rootCollection = documents?.root?.[rootField] || {};
+  return rtlOwn(rootCollection, normalizeId(entityId))
+    ? rootCollection[normalizeId(entityId)]
+    : null;
+};
 const rtlCloneDocuments = (documents = {}) => ({
+  ...clone(documents || {}),
   root: clone(documents.root || null),
   records: clone(documents.records || {}),
   folders: clone(documents.folders || {}),
@@ -4906,6 +5961,24 @@ const rtlCloneDocuments = (documents = {}) => ({
   ops: {}
 });
 const rtlMergeOrder = (...orders) => normalizeOrder(orders.flatMap((order) => toArray(order)));
+const rtlIsSafeOpaqueGroupId = (value) => (
+  typeof value === 'string' && value.length > 0 &&
+  new TextEncoder().encode(value).byteLength <= RECORD_TIMELABEL_SAFE_ID_MAX_BYTES &&
+  !/[\u0000-\u001F\u007F-\u009F]/u.test(value)
+);
+const rtlHasUnsafeOrderId = (order, {opaqueGroup = false} = {}) => toArray(order).some((id) => (
+  opaqueGroup ? !rtlIsSafeOpaqueGroupId(id) : !rtlIsSafeDocumentId(id)
+));
+const rtlMergeOpaqueOrder = (...orders) => {
+  const seen = new Set();
+  const result = [];
+  orders.flatMap((order) => toArray(order)).forEach((id) => {
+    if (!rtlIsSafeOpaqueGroupId(id) || seen.has(id)) return;
+    seen.add(id);
+    result.push(id);
+  });
+  return result;
+};
 /**
  * Group order ids are opaque to this package — mergeLocalRemote deliberately stops filtering them,
  * so the planner must not drop ids on a prefix guess either.
@@ -4934,7 +6007,7 @@ const rtlValidateIdList = (value, index, field, errors) => {
     errors.push(`operation_${index}_invalid_${field}`);
     return;
   }
-  if (value.some((id) => !normalizeId(id) || normalizeId(id).length > 512)) {
+  if (value.some((id) => !rtlIsSafeDocumentId(id))) {
     errors.push(`operation_${index}_invalid_${field}`);
   }
 };
@@ -5029,9 +6102,10 @@ const rtlValidateOperationPayload = (operation, index, errors, options = {}) =>
 export const validateRecordTimeLabelOperationBatch = (body = {}, options = {}) => {
   const errors = [];
   const requireLifecycleGeneration = options.requireLifecycleGeneration === true ||
-    toArray(body?.client?.capabilities).includes(
-      RECORD_TIMELABEL_CAPABILITY_LIFECYCLE_GENERATION_FENCE
-    );
+    toArray(body?.client?.capabilities).some((capability) => (
+      capability === RECORD_TIMELABEL_CAPABILITY_LIFECYCLE_GENERATION_FENCE ||
+      capability === RECORD_TIMELABEL_CAPABILITY_LIFECYCLE_GENERATION_FENCE_V1
+    ));
   let requestBytes = 0;
   try {
     requestBytes = rtlByteLength(JSON.stringify(body));
@@ -5042,7 +6116,8 @@ export const validateRecordTimeLabelOperationBatch = (body = {}, options = {}) =
   if (body.protocolVersion !== RTL_SYNC_PROTOCOL_VERSION) {
     errors.push('unsupported_protocol_version');
   }
-  if (!/^[A-Za-z0-9._:-]{8,160}$/.test(normalizeId(body.requestId))) {
+  if (!/^[A-Za-z0-9._:-]{8,160}$/.test(body.requestId) ||
+    !rtlIsSafeDocumentId(body.requestId)) {
     errors.push('invalid_request_id');
   }
   if (!RTL_SYNC_CLIENT_APPS.has(body.client?.app)) errors.push('invalid_client_app');
@@ -5056,8 +6131,8 @@ export const validateRecordTimeLabelOperationBatch = (body = {}, options = {}) =
   }
   const operationIds = new Set();
   operations.forEach((operation, index) => {
-    const id = normalizeId(operation?.id);
-    if (!id || id.length > 200) errors.push(`operation_${index}_invalid_id`);
+    const id = operation?.id;
+    if (!rtlIsSafeDocumentId(id) || id.length > 200) errors.push(`operation_${index}_invalid_id`);
     if (operationIds.has(id)) errors.push(`operation_${index}_duplicate_id`);
     operationIds.add(id);
     if (!RTL_SUPPORTED_OPERATION_TYPES.has(operation?.type)) {
@@ -5083,12 +6158,16 @@ export const validateRecordTimeLabelOperationBatch = (body = {}, options = {}) =
     if (!toFiniteTimestamp(operation?.createdAt)) {
       errors.push(`operation_${index}_invalid_created_at`);
     }
-    if (rtlOperationRecordId(operation).length > 512) {
+    if (rtlOperationRecordId(operation) && !rtlIsSafeDocumentId(rtlOperationRecordId(operation))) {
       errors.push(`operation_${index}_invalid_record_id`);
     }
-    if (rtlOperationFolderId(operation).length > 512) {
+    if (rtlOperationFolderId(operation) && !rtlIsSafeDocumentId(rtlOperationFolderId(operation))) {
       errors.push(`operation_${index}_invalid_folder_id`);
     }
+    const trashEntryId = rtlOperationTrashEntryId(operation);
+    if (trashEntryId && !rtlIsSafeDocumentId(trashEntryId)) {
+      errors.push(`operation_${index}_invalid_trash_entry_id`);
+    }
   });
 
   return {ok: errors.length === 0, errors, requestBytes, operations};
@@ -5124,13 +6203,35 @@ export const buildFirestoreV2OperationReadPlan = (operations = []) => {
         if (recordId) {
           recordIds.add(recordId);
           lifecycleTombstoneIds.add(rtlLifecycleTombstoneDocumentId('record', recordId));
+          trashEntryIds.add(normalizeId(payload.trashEntryId) || `record:${recordId}`);
         }
         break;
       }
       case OPERATION_TYPES.RECORD_RESTORE:
+      case OPERATION_TYPES.FOLDER_RESTORE:
       case OPERATION_TYPES.TRASH_PURGE: {
         const trashEntryId = rtlOperationTrashEntryId(operation);
         if (trashEntryId) trashEntryIds.add(trashEntryId);
+        const explicitEntityId = normalizeId(
+          payload.recordId || payload.folderId || payload.entityId
+        );
+        const inferredKind = operation.type === OPERATION_TYPES.FOLDER_RESTORE
+          ? 'folder'
+          : operation.type === OPERATION_TYPES.RECORD_RESTORE
+            ? 'record'
+            : null;
+        let decodedTrashEntryId = trashEntryId;
+        try { decodedTrashEntryId = decodeURIComponent(trashEntryId || ''); } catch { /* keep raw */ }
+        const inferredEntityId = explicitEntityId || (
+          inferredKind && decodedTrashEntryId?.startsWith(`${inferredKind}:`)
+            ? normalizeId(decodedTrashEntryId.slice(inferredKind.length + 1))
+            : ''
+        );
+        if (inferredKind && inferredEntityId) {
+          lifecycleTombstoneIds.add(
+            rtlLifecycleTombstoneDocumentId(inferredKind, inferredEntityId)
+          );
+        }
         break;
       }
       case OPERATION_TYPES.RECORD_REORDER:
@@ -5219,7 +6320,8 @@ const rtlApplyOperationToPartialDocuments = ({
 
 const rtlCanRestoreLocalFolder = (root, folder) => {
   if (!folder?.id) return false;
-  const tombstone = root?.deletedFolderTombstones?.[folder.id];
+  const tombstones = root?.deletedFolderTombstones;
+  const tombstone = rtlOwn(tombstones, folder.id) ? tombstones[folder.id] : null;
   return !tombstone;
 };
 
@@ -5230,8 +6332,9 @@ const rtlBuildLocalFolderDocument = (folder, now) => {
   }, {now}).folders[folder.id] || null;
 };
 
-const rtlEnsureTargetFolder = ({root, folders, localState, folderId, now}) => {
-  if (folders[folderId]) return folders[folderId];
+const rtlEnsureTargetFolder = ({root, folders, localState, folderId, now, allowContext = false}) => {
+  if (rtlOwn(folders, folderId)) return folders[folderId];
+  if (!allowContext) return null;
   const localFolder = toArray(localState?.folders)
     .find((folder) => folder?.id === folderId);
   if (!localFolder || !rtlCanRestoreLocalFolder(root, localFolder)) return null;
@@ -5246,7 +6349,19 @@ const rtlEnsureTargetFolder = ({root, folders, localState, folderId, now}) => {
 
 const rtlSetRoot = (target, source) => {
   Object.keys(target).forEach((key) => delete target[key]);
-  Object.assign(target, clone(source || {}));
+  const next = clone(source || {});
+  // `Object.assign` invokes the legacy `__proto__` setter on a normal target.
+  // Define each own key as data instead, so malformed legacy/root documents
+  // cannot mutate the candidate's prototype while the planner is rebuilding
+  // its immutable document map.
+  Reflect.ownKeys(next).forEach((key) => {
+    Object.defineProperty(target, key, {
+      value: next[key],
+      enumerable: true,
+      configurable: true,
+      writable: true
+    });
+  });
 };
 
 /**
@@ -5257,22 +6372,48 @@ export const planFirestoreV2OperationChanges = ({
   operations,
   localState = {},
   now = Date.now(),
-  requireLifecycleGeneration = true
+  requireLifecycleGeneration = true,
+  plannerMode = RECORD_TIMELABEL_PLANNER_MODES.LEGACY_CONTEXT
 } = {}) => {
+  const selectedPlannerMode = plannerMode === RECORD_TIMELABEL_PLANNER_MODES.DETERMINISTIC
+    ? RECORD_TIMELABEL_PLANNER_MODES.DETERMINISTIC
+    : RECORD_TIMELABEL_PLANNER_MODES.LEGACY_CONTEXT;
+  const allowContext = selectedPlannerMode === RECORD_TIMELABEL_PLANNER_MODES.LEGACY_CONTEXT;
   const previousDocuments = rtlCloneDocuments(documents);
   const nextDocuments = rtlCloneDocuments(documents);
   const preservedExpandedGroups = previousDocuments.root &&
     Object.prototype.hasOwnProperty.call(previousDocuments.root, 'expandedGroups')
     ? clone(previousDocuments.root.expandedGroups)
     : undefined;
-  const normalizedLocalState = normalizeState(localState || {});
+  // The deterministic planner deliberately does not inspect mutable local
+  // context.  Keep the old context-assisted behaviour behind an explicit
+  // legacy mode so rolling clients can continue to use it while gateways
+  // migrate to the stricter input contract.
+  const normalizedLocalState = allowContext ? normalizeState(localState || {}) : {};
   const operationResults = [];
   let changed = false;
   if (!nextDocuments.root) {
-    return {requiresMigration: true, previousDocuments, nextDocuments, operationResults};
+    return {
+      requiresMigration: true,
+      plannerMode: selectedPlannerMode,
+      previousDocuments,
+      nextDocuments,
+      operationResults
+    };
   }
 
   for (const operation of toArray(operations).filter(Boolean)) {
+    const operationId = operation?.id;
+    if (!rtlIsSafeDocumentId(operationId) || operationId.length > 200) {
+      operationResults.push({
+        id: operationId ?? null,
+        type: operation?.type ?? null,
+        applied: false,
+        status: 'rejected',
+        reason: 'invalid_document_id'
+      });
+      continue;
+    }
     if (operation?.type === OPERATION_TYPES.EXPANDED_GROUPS_UPDATE) {
       operationResults.push({
         id: operation.id || null,
@@ -5287,21 +6428,33 @@ export const planFirestoreV2OperationChanges = ({
     const operationNow = toFiniteTimestamp(operation.createdAt || payload.updatedAt) || now;
     const recordId = rtlOperationRecordId(operation);
     const folderId = rtlOperationFolderId(operation);
+    const trashEntryId = rtlOperationTrashEntryId(operation);
     let applied = null;
     let reason = null;
     let lifecycleTombstoneId = null;
 
-    switch (operation.type) {
+    // Never use prototype-inherited values as document snapshots.  Apart
+    // from being incorrect for IDs such as "constructor", doing so would
+    // allow user-controlled Firestore IDs to reach unsafe map writes.
+    if ((recordId && !rtlIsSafeDocumentId(recordId)) ||
+      (folderId && !rtlIsSafeDocumentId(folderId)) ||
+      (trashEntryId && !rtlIsSafeDocumentId(trashEntryId))) {
+      reason = 'invalid_document_id';
+    }
+
+    switch (reason ? null : operation.type) {
       case OPERATION_TYPES.RECORD_CREATE: {
         if (!recordId) { reason = 'missing_record_id'; break; }
-        if (nextDocuments.records[recordId]) { reason = 'already_exists'; break; }
+        if (rtlOwn(nextDocuments.records, recordId)) { reason = 'already_exists'; break; }
         const targetFolderId = safeFolderId(payload.folderId || payload.record?.folderId);
         applied = rtlApplyOperationToPartialDocuments({
           ...nextDocuments,
           operation: {...operation, payload: {...payload, folderId: targetFolderId}},
           now: operationNow
         });
-        const recordDocument = applied.documents.records[recordId];
+        const recordDocument = rtlOwn(applied.documents.records, recordId)
+          ? applied.documents.records[recordId]
+          : null;
         if (!recordDocument) { reason = 'blocked_by_tombstone'; break; }
         const candidateRoot = clone(applied.documents.root);
         const candidateFolders = clone(nextDocuments.folders);
@@ -5310,7 +6463,8 @@ export const planFirestoreV2OperationChanges = ({
           folders: candidateFolders,
           localState: normalizedLocalState,
           folderId: targetFolderId,
-          now: operationNow
+          now: operationNow,
+          allowContext
         });
         if (!targetFolder) {
           reason = 'folder_not_found';
@@ -5324,13 +6478,17 @@ export const planFirestoreV2OperationChanges = ({
         break;
       }
       case OPERATION_TYPES.RECORD_UPDATE: {
-        const existing = nextDocuments.records[recordId];
+        const existing = rtlOwn(nextDocuments.records, recordId)
+          ? nextDocuments.records[recordId]
+          : null;
         if (!recordId || !existing) {
           reason = recordId ? 'record_not_found' : 'missing_record_id';
           break;
         }
         applied = rtlApplyOperationToPartialDocuments({...nextDocuments, operation, now: operationNow});
-        const recordDocument = applied.documents.records[recordId];
+        const recordDocument = rtlOwn(applied.documents.records, recordId)
+          ? applied.documents.records[recordId]
+          : null;
         if (!recordDocument) { reason = 'record_not_found'; break; }
         rtlSetRoot(nextDocuments.root, applied.documents.root);
         nextDocuments.records[recordId] = recordDocument;
@@ -5338,7 +6496,9 @@ export const planFirestoreV2OperationChanges = ({
         break;
       }
       case OPERATION_TYPES.RECORD_MOVE: {
-        const existing = nextDocuments.records[recordId];
+        const existing = rtlOwn(nextDocuments.records, recordId)
+          ? nextDocuments.records[recordId]
+          : null;
         if (!recordId || !existing) {
           reason = recordId ? 'record_not_found' : 'missing_record_id';
           break;
@@ -5350,7 +6510,9 @@ export const planFirestoreV2OperationChanges = ({
           operation: {...operation, payload: {...payload, targetFolderId}},
           now: operationNow
         });
-        const recordDocument = applied.documents.records[recordId];
+        const recordDocument = rtlOwn(applied.documents.records, recordId)
+          ? applied.documents.records[recordId]
+          : null;
         if (!recordDocument) { reason = 'record_not_found'; break; }
         const candidateRoot = clone(applied.documents.root);
         const candidateFolders = clone(nextDocuments.folders);
@@ -5359,10 +6521,11 @@ export const planFirestoreV2OperationChanges = ({
           folders: candidateFolders,
           localState: normalizedLocalState,
           folderId: targetFolderId,
-          now: operationNow
+          now: operationNow,
+          allowContext
         });
         if (!targetFolder) { reason = 'folder_not_found'; break; }
-        if (candidateFolders[sourceFolderId]) {
+        if (rtlOwn(candidateFolders, sourceFolderId)) {
           candidateFolders[sourceFolderId].recordOrder = rtlMergeOrder(
             candidateFolders[sourceFolderId].recordOrder
           ).filter((id) => id !== recordId);
@@ -5379,8 +6542,14 @@ export const planFirestoreV2OperationChanges = ({
       }
       case OPERATION_TYPES.RECORD_REORDER: {
         const targetFolderId = safeFolderId(payload.folderId);
-        const targetFolder = nextDocuments.folders[targetFolderId];
+        const targetFolder = rtlOwn(nextDocuments.folders, targetFolderId)
+          ? nextDocuments.folders[targetFolderId]
+          : null;
         const requested = rtlPayloadOrder(operation, ['recordIds']);
+        if (rtlHasUnsafeOrderId(requested)) {
+          reason = 'invalid_document_id';
+          break;
+        }
         if (!targetFolder || requested.length === 0) {
           reason = targetFolder ? 'missing_record_order' : 'folder_not_found';
           break;
@@ -5394,14 +6563,50 @@ export const planFirestoreV2OperationChanges = ({
       case OPERATION_TYPES.RECORD_DELETE: {
         if (!recordId) { reason = 'missing_record_id'; break; }
         lifecycleTombstoneId = rtlLifecycleTombstoneDocumentId('record', recordId);
-        const sourceFolderId = safeFolderId(nextDocuments.records[recordId]?.folderId);
+        const existingRecord = rtlOwn(nextDocuments.records, recordId)
+          ? nextDocuments.records[recordId]
+          : null;
+        const operationTrashEntryId = trashEntryId || `record:${recordId}`;
+        const existingTrashEntry = rtlOwn(nextDocuments.trash, operationTrashEntryId)
+          ? nextDocuments.trash[operationTrashEntryId]
+          : null;
+        const existingTombstone = rtlGetLifecycleTombstone(nextDocuments, 'record', recordId);
+        if (!existingRecord) {
+          const hasTrash = Boolean(existingTrashEntry);
+          const hasTombstone = Boolean(existingTombstone);
+          const trashGeneration = Number(existingTrashEntry?.lifecycleGeneration || 0);
+          const tombstoneGeneration = Number(existingTombstone?.lifecycleGeneration || 0);
+          const validTrashGeneration = Number.isSafeInteger(trashGeneration) && trashGeneration > 0;
+          const validTombstoneGeneration = Number.isSafeInteger(tombstoneGeneration) &&
+            tombstoneGeneration > 0;
+          if (hasTrash && hasTombstone) {
+            reason = validTrashGeneration && validTombstoneGeneration &&
+              trashGeneration === tombstoneGeneration
+              ? 'already_deleted'
+              : 'lifecycle_conflict';
+          } else if (hasTombstone) {
+            reason = validTombstoneGeneration ? 'already_deleted' : 'lifecycle_conflict';
+          } else if (hasTrash) {
+            reason = 'lifecycle_conflict';
+          } else {
+            reason = 'record_not_found';
+          }
+          break;
+        }
+        if (existingTombstone && Number(existingTombstone.lifecycleGeneration || 0) >=
+          Number(existingRecord.lifecycleGeneration || 0)) {
+          reason = 'already_deleted';
+          break;
+        }
+        const sourceFolderId = safeFolderId(existingRecord.folderId);
         applied = rtlApplyOperationToPartialDocuments({...nextDocuments, operation, now: operationNow});
         rtlSetRoot(nextDocuments.root, applied.documents.root);
-        const trashEntryId = normalizeId(payload.trashEntryId) || `record:${recordId}`;
-        const trashDocument = applied.documents.trash?.[trashEntryId];
-        if (trashDocument) nextDocuments.trash[trashEntryId] = trashDocument;
+        const trashDocument = rtlOwn(applied.documents.trash, operationTrashEntryId)
+          ? applied.documents.trash[operationTrashEntryId]
+          : null;
+        if (trashDocument) nextDocuments.trash[operationTrashEntryId] = trashDocument;
         delete nextDocuments.records[recordId];
-        if (nextDocuments.folders[sourceFolderId]) {
+        if (rtlOwn(nextDocuments.folders, sourceFolderId)) {
           nextDocuments.folders[sourceFolderId].recordOrder = rtlMergeOrder(
             nextDocuments.folders[sourceFolderId].recordOrder
           ).filter((id) => id !== recordId);
@@ -5410,8 +6615,10 @@ export const planFirestoreV2OperationChanges = ({
         break;
       }
       case OPERATION_TYPES.RECORD_RESTORE: {
-        const trashEntryId = rtlOperationTrashEntryId(operation);
-        const trashEntry = nextDocuments.trash[trashEntryId];
+        const restoreTrashEntryId = trashEntryId;
+        const trashEntry = rtlOwn(nextDocuments.trash, restoreTrashEntryId)
+          ? nextDocuments.trash[restoreTrashEntryId]
+          : null;
         if (!trashEntry) { reason = 'trash_entry_not_found'; break; }
         const expectedGeneration = normalizeExpectedGeneration(payload.expectedGeneration);
         if (requireLifecycleGeneration !== false && expectedGeneration === null) {
@@ -5427,11 +6634,23 @@ export const planFirestoreV2OperationChanges = ({
           break;
         }
         const restoredRecordId = normalizeId(trashEntry.entityId);
-        if (!restoredRecordId || nextDocuments.records[restoredRecordId]) {
+        if (!restoredRecordId || rtlOwn(nextDocuments.records, restoredRecordId)) {
           reason = restoredRecordId ? 'already_exists' : 'missing_record_id';
           break;
         }
         lifecycleTombstoneId = rtlLifecycleTombstoneDocumentId('record', restoredRecordId);
+        if (requireLifecycleGeneration !== false) {
+          const lifecycleTombstone = rtlGetLifecycleTombstone(
+            nextDocuments,
+            'record',
+            restoredRecordId
+          );
+          if (!lifecycleTombstone ||
+            Number(lifecycleTombstone.lifecycleGeneration) !== Number(trashEntry.lifecycleGeneration)) {
+            reason = 'lifecycle_conflict';
+            break;
+          }
+        }
         // Explicit legacy compatibility is planner-local. It does not change the
         // original operation, its wire bytes, or the strict durable reducer contract.
         const reducerOperation = requireLifecycleGeneration === false && expectedGeneration === null
@@ -5442,11 +6661,16 @@ export const planFirestoreV2OperationChanges = ({
           operation: reducerOperation,
           now: operationNow
         });
-        const restoredRecord = applied.documents.records[restoredRecordId];
+        const restoredRecord = rtlOwn(applied.documents.records, restoredRecordId)
+          ? applied.documents.records[restoredRecordId]
+          : null;
         if (!restoredRecord) { reason = 'restore_conflict'; break; }
         const targetFolderId = safeFolderId(restoredRecord.folderId || trashEntry.originalFolderId);
-        const targetFolder = nextDocuments.folders[targetFolderId] ||
-          nextDocuments.folders[DEFAULT_FOLDER_ID];
+        const targetFolder = (rtlOwn(nextDocuments.folders, targetFolderId)
+          ? nextDocuments.folders[targetFolderId]
+          : null) || (rtlOwn(nextDocuments.folders, DEFAULT_FOLDER_ID)
+            ? nextDocuments.folders[DEFAULT_FOLDER_ID]
+            : null);
         if (!targetFolder) { reason = 'folder_not_found'; break; }
         rtlSetRoot(nextDocuments.root, applied.documents.root);
         nextDocuments.records[restoredRecordId] = restoredRecord;
@@ -5462,8 +6686,10 @@ export const planFirestoreV2OperationChanges = ({
         break;
       }
       case OPERATION_TYPES.TRASH_PURGE: {
-        const trashEntryId = rtlOperationTrashEntryId(operation);
-        const trashEntry = nextDocuments.trash[trashEntryId];
+        const purgeTrashEntryId = trashEntryId;
+        const trashEntry = rtlOwn(nextDocuments.trash, purgeTrashEntryId)
+          ? nextDocuments.trash[purgeTrashEntryId]
+          : null;
         if (!trashEntry) { reason = 'trash_entry_not_found'; break; }
         const expectedGeneration = normalizeExpectedGeneration(payload.expectedGeneration);
         if (requireLifecycleGeneration !== false && expectedGeneration === null) {
@@ -5474,20 +6700,24 @@ export const planFirestoreV2OperationChanges = ({
           reason = 'lifecycle_conflict';
           break;
         }
-        delete nextDocuments.trash[trashEntryId];
+        delete nextDocuments.trash[purgeTrashEntryId];
         changed = true;
         break;
       }
       case OPERATION_TYPES.FOLDER_CREATE:
       case OPERATION_TYPES.FOLDER_UPDATE: {
         if (!folderId) { reason = 'missing_folder_id'; break; }
-        if (operation.type === OPERATION_TYPES.FOLDER_UPDATE && !nextDocuments.folders[folderId]) {
+        if (operation.type === OPERATION_TYPES.FOLDER_UPDATE && !rtlOwn(nextDocuments.folders, folderId)) {
           reason = 'folder_not_found';
           break;
         }
-        const previousOrder = nextDocuments.folders[folderId]?.recordOrder || [];
+        const previousOrder = rtlOwn(nextDocuments.folders, folderId)
+          ? nextDocuments.folders[folderId]?.recordOrder || []
+          : [];
         applied = rtlApplyOperationToPartialDocuments({...nextDocuments, operation, now: operationNow});
-        const folderDocument = applied.documents.folders[folderId];
+        const folderDocument = rtlOwn(applied.documents.folders, folderId)
+          ? applied.documents.folders[folderId]
+          : null;
         if (!folderDocument) { reason = 'folder_not_found'; break; }
         rtlSetRoot(nextDocuments.root, applied.documents.root);
         nextDocuments.folders[folderId] = {
@@ -5507,27 +6737,37 @@ export const planFirestoreV2OperationChanges = ({
       case OPERATION_TYPES.FOLDER_REORDER:
       case OPERATION_TYPES.GROUP_REORDER:
       case OPERATION_TYPES.SETTINGS_UPDATE: {
+        if (operation.type === OPERATION_TYPES.FOLDER_REORDER &&
+          rtlHasUnsafeOrderId(rtlPayloadOrder(operation, ['folderOrder', 'order']))) {
+          reason = 'invalid_document_id';
+          break;
+        }
+        if (operation.type === OPERATION_TYPES.GROUP_REORDER &&
+          rtlHasUnsafeOrderId(rtlPayloadOrder(operation, ['groupOrder', 'order']), {opaqueGroup: true})) {
+          reason = 'invalid_document_id';
+          break;
+        }
         applied = rtlApplyOperationToPartialDocuments({...nextDocuments, operation, now: operationNow});
         const appliedRoot = applied.documents.root;
         if (operation.type === OPERATION_TYPES.FOLDER_REORDER) {
           appliedRoot.folderOrder = rtlMergeOrder(
             rtlPayloadOrder(operation, ['folderOrder', 'order']),
             nextDocuments.root.folderOrder,
-            normalizedLocalState.folderOrder
+            ...(allowContext ? [normalizedLocalState.folderOrder] : [])
           );
         } else if (operation.type === OPERATION_TYPES.GROUP_REORDER) {
-          appliedRoot.groupOrder = rtlNormalizeGroupOrder(rtlMergeOrder(
+          appliedRoot.groupOrder = rtlMergeOpaqueOrder(
             rtlPayloadOrder(operation, ['groupOrder', 'order']),
             nextDocuments.root.groupOrder,
-            normalizedLocalState.groupOrder
-          ));
+            ...(allowContext ? [normalizedLocalState.groupOrder] : [])
+          );
         }
         rtlSetRoot(nextDocuments.root, appliedRoot);
         changed = true;
         break;
       }
       default:
-        reason = 'unsupported_operation';
+        if (!reason) reason = 'unsupported_operation';
     }
     if (applied && !reason && lifecycleTombstoneId) {
       const nextTombstone = applied.documents.lifecycleTombstones?.[lifecycleTombstoneId];
@@ -5541,6 +6781,7 @@ export const planFirestoreV2OperationChanges = ({
       id: operation.id || null,
       type: operation.type || null,
       applied: !reason,
+      ...(reason === 'already_deleted' ? {status: 'noop'} : {}),
       reason
     });
   }
@@ -5562,6 +6803,7 @@ export const planFirestoreV2OperationChanges = ({
   });
   return {
     requiresMigration: false,
+    plannerMode: selectedPlannerMode,
     previousDocuments,
     nextDocuments,
     changes,
@@ -5569,6 +6811,19 @@ export const planFirestoreV2OperationChanges = ({
   };
 };
 
+// Dedicated API boundary for gateways: deterministic planning cannot inspect
+// mutable host/local context and always uses the immutable-ID contract.
+export const planRecordTimeLabelDeterministicOperationChanges = (options = {}) => (
+  planFirestoreV2OperationChanges({
+    ...options,
+    plannerMode: RECORD_TIMELABEL_PLANNER_MODES.DETERMINISTIC,
+    localState: {}
+  })
+);
+// Canonical name used by the Firestore gateway capability probe.
+export const planFirestoreV2DeterministicOperationChanges =
+  planRecordTimeLabelDeterministicOperationChanges;
+
 /**
  * Counts all billable writes before a transaction reserves quota.
  */
@@ -5759,10 +7014,15 @@ export default {
   isValidChannelName,
   RECORD_TIMELABEL_DURABLE_ENGINE_CAPABILITIES,
   RECORD_TIMELABEL_CAPABILITY_CLOUD_FAILURE_STATE,
+  RECORD_TIMELABEL_CAPABILITY_DETERMINISTIC_PLANNER,
   RECORD_TIMELABEL_CAPABILITY_LIFECYCLE_GENERATION_FENCE,
+  RECORD_TIMELABEL_CAPABILITY_LIFECYCLE_GENERATION_FENCE_V1,
   RECORD_TIMELABEL_CAPABILITY_OPERATION_CONFLICT_QUARANTINE,
   RECORD_TIMELABEL_CAPABILITY_STRICT_OPERATION_RESULTS,
+  RECORD_TIMELABEL_CAPABILITY_STRICT_READINESS,
+  RECORD_TIMELABEL_CLOUD_FAILURE_SCHEMA_VERSION,
   RECORD_TIMELABEL_CLOUD_FAILURE_CLASSES,
+  isRecordTimeLabelOperationConflictFailure,
   normalizeRecordTimeLabelCloudFailure,
   toRecordTimeLabelCloudFailureError,
   RECORD_TIMELABEL_OPERATION_RESULT_STATUSES,
@@ -5774,6 +7034,11 @@ export default {
   RTL_MAX_REQUEST_BYTES,
   RTL_MAX_TARGET_WRITES,
   RTL_TRASH_RETENTION_MS,
+  RECORD_TIMELABEL_PLANNER_MODES,
+  RECORD_TIMELABEL_SAFE_ID_MAX_BYTES,
+  isRecordTimeLabelSafeDocumentId,
+  normalizeRecordTimeLabelImmutableId,
+  normalizeRecordTimeLabelPlannerId,
   OPERATION_TYPES,
   RECORD_TIMELABEL_SYNC_MODES,
   RECORD_TIMELABEL_CLOUD_SCHEMAS,
@@ -5812,6 +7077,8 @@ export default {
   extendFirestoreV2OperationReadPlanWithRecords,
   extendFirestoreV2OperationReadPlanWithTrash,
   planFirestoreV2OperationChanges,
+  planRecordTimeLabelDeterministicOperationChanges,
+  planFirestoreV2DeterministicOperationChanges,
   estimateFirestoreV2WriteUnits,
   normalizeRecordTimeLabelOperationResults,
   normalizeRecordTimeLabelEnvelopeResponse,
@@ -5822,6 +7089,7 @@ export default {
   flushPendingOperations,
   mergeRemoteStateIntoLocal,
   applyOperation,
+  applyExplicitRecordUpdate,
   applyRecordTimeLabelOperation,
   createOperation,
   createRecordTimeLabelSyncEngine,