@rindle/optimistic 0.4.3 → 0.5.0

package/dist/backend.d.ts

@@ -1,4 +1,7 @@
-import type { Ast, Backend, BackendDevObserver, ChangeEvent, ColsMap, IsoTx, KeyedRow, Mutation, MutationGen, MutatorCtx, OptimisticSource, QueryArg, QueryId, QueryResultRow, RemoteQuery, ResultType, Schema, WireValue } from "@rindle/client";
+import type { Ast, Backend, BackendDevObserver, ChangeEvent, ColsMap, Condition, IsoTx, KeyedRow, Mutation, MutationEnvelope, MutationGen, MutatorCtx, OptimisticSource, QueryArg, QueryId, QueryResultRow, RemoteQuery, ResultType, Schema, WireValue } from "@rindle/client";
+import { type WritableDescriptor } from "@rindle/wasm";
+import { type SystemStreamSpec } from "./system-streams.ts";
+export type { SystemStreamSpec, SystemStreamTable } from "./system-streams.ts";
 /** A keyed row: column name → cell. The ergonomic shape — column names are validated against the
  *  schema at runtime, so a typo throws immediately with the valid names. Re-exported from
  *  `@rindle/client` (the leaf both tiers share). */
@@ -52,6 +55,178 @@ export type ClientMutator = ((tx: MutationTx, args: never) => void) | ((tx: IsoT
  *  twin shares names (and possibly code), never the wire. */
 export type ClientRegistry = Record<string, ClientMutator>;
 export type { ResultType };
+/** One captured write, pk-granular (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §3.2 #1: "the
+ *  writers already receive `(table, row)`... this is pure capture, no semantic change"). `row` is
+ *  the post-write image (positional wire cells, schema column order); `undefined` for a `remove` —
+ *  no row survives it, and `row === undefined` stays the remove marker.
+ *
+ *  `oldRow` is the PRE-IMAGE, captured for a `remove` (G-iii, §7.3 tombstone) AND — since H-ii —
+ *  an `edit` (it feeds H-iii's join-key no-change rule, old vs new join-key cells, and mirrors the
+ *  engine, which routes an Edit by its OLD row — the H-i handoff): the full-width row read via
+ *  `tx.get` immediately BEFORE the write staged — read-your-writes, so a write to the same pk
+ *  earlier in the SAME invocation shows through — falling back to the caller's asserted old row
+ *  when the pk is not txn-visible (a raw remove/edit of an absent row; incl. the pk-MOVING raw
+ *  edit, whose record is keyed by the NEW pk yet whose pre-image is the caller's OLD row — the row
+ *  H-i's `provenanceOf` routes by). A captured remove/edit thus always carries a full-width
+ *  pre-image (the engine width-checks `holdBackAbsent`; Slice H evaluates writable predicates on
+ *  it) — with ONE exception: a record that collapses to a (re-)insert has none, see the matrix.
+ *
+ *  Coalescing within one invocation is last-write-wins per pk on `row` (the final image matches
+ *  the engine head's own semantics for that pk) with `oldRow` pinned to the TXN-ENTRY BASE — the
+ *  H-ii matrix:
+ *    - edit-after-add / edit-after-remove: the record collapses to a (re-)insert — post-image
+ *      only, NO `oldRow` (the pk did not pre-exist this invocation's base; presence hold-back
+ *      uses `row`).
+ *    - edit-after-edit: keeps the FIRST pre-image (the txn-entry base — the chain nets to ONE
+ *      edit from the base to the final image).
+ *    - remove-after-edit / remove-after-remove: keeps the ORIGINAL pre-image (the first write's
+ *      captured base), NOT the edited transient — the net effect is a remove of the row the
+ *      external world last knew.
+ *    - remove-after-add: keeps the txn-visible pre-image (the transient added row — the pk had
+ *      no base, and this is the only truthful full-width row there is; G-iii pinned it).
+ *    - add-after-remove (a re-insert): drops `oldRow` (presence hold-back uses `row`).
+ *  Across rebase re-invocations the write-set is union-never-shrink ({@link mergeWriteSet}): a
+ *  re-run that no-ops keeps the prior record — and its pre-image — intact. */
+export interface WriteRecord {
+    table: string;
+    pk: WireValue[];
+    row: WireValue[] | undefined;
+    oldRow?: WireValue[];
+}
+/** The pk-granular write-set captured over ONE mutator invocation: table → pk-key (a stable-JSON
+ *  encoding of the pk cells, {@link stableJson}) → that pk's write, LAST-WRITE-WINS within the
+ *  invocation — an add-then-edit or edit-then-edit of the SAME pk collapses to its final image,
+ *  matching the engine head's own semantics for that pk. Chosen (over a flat array) because the
+ *  later routing proof needs "is pk P in the writable scope" / "did we already see this pk in this
+ *  invocation" as cheap lookups, and rebase re-invocation needs to MERGE a fresh write-set into an
+ *  accumulated one ({@link mergeWriteSet}) — both are Map operations, not scans.
+ *
+ *  `touched` (the pre-existing table-granular `Set<string>` the pending axis reads, §7.2) is
+ *  exactly `new Set(writeSet.keys())` — derived from this, never separately populated, so the two
+ *  can never drift. */
+export type WriteSet = Map<string, Map<string, WriteRecord>>;
+/** Whether a recorded point read (`tx.get`/`tx.row`) found a row. */
+export type ReadOutcome = "present" | "absent";
+/** One recorded point read, pk-granular (§3.2 #2). Recording-mode only — see {@link ReadLog}.
+ *  Since H-ii this covers BOTH the public reads (`tx.get`/`tx.row`) and the keyed writers'
+ *  internal pre-existence probes (§3.2 #3 — see the `rawGet` note in {@link trackingTx}). */
+export interface ReadRecord {
+    table: string;
+    pk: WireValue[];
+    outcome: ReadOutcome;
+    /** Per-read provenance (H-ii, §3.2 #3): the engine's `provenanceOf` answer AT THE MOMENT OF THE
+     *  READ — which source ("daemon" / a room key) served the row the mutator saw. Live pre-commit
+     *  state: an open txn's staged writes are not consulted (H-i), so a PRESENT read of a pk this
+     *  txn itself created reports `undefined` — recorded honestly, key omitted (the router treats
+     *  self-reads via write-set membership, not provenance). ABSENT reads carry no source (the
+     *  mutator saw no row; there is no full-width row to probe with — a pk this txn staged-removed
+     *  thus also records `undefined`, again a write-set-membership case for the router). Probed only
+     *  on a PROMOTED table ({@link promotedTables}): a never-promoted (Collapsed) table is
+     *  daemon-owned by construction, so a pure single-domain app pays zero wasm calls per read and
+     *  `undefined` is still correct (everything is daemon-owned). One probe call per recorded
+     *  present read, at read time. */
+    source?: string;
+}
+/** The read-log captured over ONE mutator invocation when recording is armed (RINDLE-REALTIME-
+ *  QUERY-ENABLEMENT-DESIGN.md §3.2 #2): every point read (`reads` — the public `tx.get`/`tx.row`
+ *  and, since H-ii, the keyed writers' internal pre-existence probes) plus every resolved query AST
+ *  (`queries`, from `tx.query`). A SIBLING of the folded read TRAP (`FoldReadError` below) — the
+ *  trap arms on the folded path and throws before any read completes (recording never runs there);
+ *  recording arms on the ordinary (non-folded) prediction run and never throws. Pure capture: which
+ *  row/predicate a read is actually PROVEN covered by (§3.1's table) is a later slice's job. */
+export interface ReadLog {
+    reads: ReadRecord[];
+    queries: Ast[];
+}
+/** One promoted `(sourceKey, table)`'s client-held routing spec — THE per-table routing record the
+ *  §3 prove-or-slow-path router reads (H-iii). Recorded by {@link OptimisticBackend.promoteRoomTable}
+ *  in the same breath as the engine attach, from the lease's `RealtimeLeaseTableSpec` (the
+ *  api-server's `RoomTableSpec`, one compiler with the boot wire).
+ *
+ *  - `writable`: whether the room may write this table AT ALL — `true` iff the registered engine
+ *    {@link WritableDescriptor} is not `none` (a context/"followed" table is `none`; the daemon
+ *    stays write-authoritative for it, §2.2). Rule #1 of the write proof.
+ *  - `joinKeyCols`: the correlation columns the footprint binds on this table — the "room mutators
+ *    never change join keys" input (an edit with a moved join-key cell would re-parent the row
+ *    across the footprint's correlation and is refused room-routing). Deliberately client-side —
+ *    they never cross the wasm {@link WritableDescriptor} ABI (the room GATE enforces them
+ *    engine-side, H-iv).
+ *  - `where`: the lease's row-local writable predicate (advisory here — the router evaluates the
+ *    ENGINE's compiled copy via `writableMatches`, never this one; kept for introspection parity
+ *    with the wire).
+ *  - `footprintWhere`: the EXACT footprint-membership predicate (H-iv-b: root-node-only, lossless
+ *    extraction; the vacuous-true `{type:"and",conditions:[]}` for an exact unconstrained root;
+ *    ABSENT for child/correlated tables). The read proof's pk-membership test input — see
+ *    {@link OptimisticBackend.deriveDomain}. */
+export interface RoomTableRouting {
+    writable: boolean;
+    joinKeyCols: string[];
+    where?: Condition;
+    footprintWhere?: Condition;
+}
+/** The per-table spec {@link OptimisticBackend.promoteRoomTable} receives beside the engine
+ *  descriptor (H-iii spec plumbing) — the wire-facing half of {@link RoomTableRouting}
+ *  (`writable` is derived from the descriptor's kind, never passed separately). */
+export interface RoomTableRoutingSpec {
+    joinKeyCols?: readonly string[];
+    where?: Condition;
+    footprintWhere?: Condition;
+}
+/** The §3 router's Q6 measurement hook ({@link OptimisticBackend.__inspectDomains}`().routing`):
+ *  how often derivation succeeded (per derived room) and why it fell back to the daemon (per
+ *  failure reason). `reasons` counts PER-CANDIDATE proof failures plus the terminal reasons
+ *  (`no-candidates` / `tx-query` / `ambiguous`) — with multiple candidate rooms one derivation can
+ *  bump several reason counters (one per failing candidate), and a candidate's failure is counted
+ *  even when a sibling candidate ultimately proved. Explicit-policy pins bump NOTHING (the router
+ *  never ran). */
+export interface RoutingInspect {
+    /** Successful DERIVED routes, per room key. */
+    derived: Record<string, number>;
+    /** Derivation failures, per {@link RoutingFailureReason}. */
+    reasons: Record<string, number>;
+}
+/** Why a §3 derivation (or one candidate's proof) fell to the daemon — the {@link RoutingInspect}
+ *  counter keys. */
+export type RoutingFailureReason = 
+/** No connected room gate with a promoted table — the single-domain fast path. */
+"no-candidates"
+/** The invocation ran `tx.query` — a declarative read is not room-provable client-side
+ *  (rindle-cover is native-only BY DESIGN), so the whole derivation fails unconditionally. */
+ | "tx-query"
+/** Two or more candidate rooms both proved. Principled disambiguation is a §9.2 (multi-room
+ *  clients + budgets) NON-goal, deferred past Slice J; routing slow is always sound (the §3.3
+ *  gate is the contract). Reachable essentially only for zero-write mutations — real writes
+ *  can't be writable in two rooms (§2.2 exactly-one-writer per doc). */
+ | "ambiguous"
+/** A write touched a table not promoted for the candidate, or promoted `writable: none`
+ *  (context) — the room may not write it at all. */
+ | "write-unwritable-table"
+/** `writableMatches` refused the write's post-image (add/edit) or pre-image (remove). */
+ | "write-scope-miss"
+/** An edit moved a join-key cell (old vs new differ on a `joinKeyCols` column). */
+ | "write-join-key-change"
+/** The engine's provenance for the write's probe row names a DIFFERENT room. */
+ | "write-cross-room-provenance"
+/** A recorded read was served by a DIFFERENT room. */
+ | "read-cross-room"
+/** A read needed the pk-membership test but the table has no `footprintWhere` (child /
+ *  correlated / inexact extraction / never-promoted table). */
+ | "read-no-footprint-where"
+/** `footprintWhere` references a non-pk column — not decidable from the key alone. */
+ | "read-not-key-decidable"
+/** `footprintWhere` is key-decidable but outside the deliberately-minimal client evaluator
+ *  (an op other than `=`/`!=`, a null/type-mixed comparison, column-vs-column, …). */
+ | "read-not-evaluable"
+/** `footprintWhere` evaluated FALSE on the read's pk — the room provably never holds it. */
+ | "read-outside-footprint"
+/** NOT a derivation failure (H-v): a routed mutation came back `mutationOutcome
+ *  {kind:"deopt"}` — the room GATE refused it at commit and the client re-enqueued it onto the
+ *  daemon. Counted per processed deopt frame so Q6's picture is complete: derived-and-deopted
+ *  routes are visible beside derived successes (a rising `deopt` count against a rising
+ *  `derived` count means the client proof and the gate disagree — a compiler/evaluator skew
+ *  worth investigating; each one costs a room round-trip + a burnt room mid, never
+ *  correctness). */
+ | "deopt";
 /** A virtual-clock seam for the fold debounce/maxWait timers (FOLDED-MUTATIONS-DESIGN §9): the
  *  oracle injects a deterministic scheduler; production defaults to real timers + `Date.now`. */
 export interface FoldClock {
@@ -69,6 +244,15 @@ export interface FoldOptions {
     /** Hard cap so a never-idle drag still persists periodically (trailing throttle). Unbounded if
      *  omitted — an idle gap of `debounceMs` is then the only thing that flushes. */
     maxWaitMs?: number;
+    /** §9.3 room-aware cadence. When this fold's write ROUTES INTO A ROOM (a collaborator is live on
+     *  the shared head), flush at this (short) interval instead of `debounceMs`/`maxWaitMs`, so the
+     *  intermediate frames STREAM to the room rather than collapsing to last-value-wins — the pen is
+     *  watched, so its growth matters. OFF the room (solo / daemon-served) this is ignored and the
+     *  caller's `debounceMs` collapse governs. `0` ⇒ per-frame (never coalesce while in a room); a
+     *  small value (e.g. 40ms) animates while still capping the write rate. Absent ⇒ same cadence
+     *  room or not (today's behavior). The room decision is probed from the write-set at the fold
+     *  window's first invoke; it stays fixed for that window. */
+    roomDebounceMs?: number;
     /** Keep deferring across overlapping non-fold writes for maximum economy, accepting the §4.2
      *  read-dependent reorder snap. Default `false` (flush-on-enqueue — correct-and-boring). */
     deferAcrossWrites?: boolean;
@@ -80,6 +264,26 @@ export interface FoldHandle {
     flush(): void;
     readonly mid: Promise<number>;
 }
+/** One I-iv doorbell event ({@link OptimisticBackend.onScopeSessions}, §4.1): a release folded
+ *  scope-session rows for `scope`, and `others` is the count of OTHER clients' unexpired sessions
+ *  there — {@link OptimisticBackend.otherScopeSessions} evaluated at fold time (the same one rule,
+ *  on the injectable {@link FoldClock}, so a virtual-clock harness gets deterministic verdicts).
+ *  The consumer (client.ts) triggers its one debounced re-lease on the 0→≥1 transition; expired
+ *  and own-clientID rows never count, so a solo client's own row can never ring its own bell. */
+export interface ScopeSessionsEvent {
+    scope: string;
+    others: number;
+}
+/** The I-v stuck-downgrade event ({@link OptimisticBackend.onDowngradeStuck}): the ghost's fence
+ *  is satisfied but these SENT room-domain mids never resolved (an entry that never reached the
+ *  room — sent-but-undelivered when the socket died — is undecidable in general, §7.5). The ghost
+ *  HOLDS (fail LOUD, never silent; no timeout-retire is invented) and the mids are surfaced once,
+ *  actionably. */
+export interface DowngradeStuckEvent {
+    sourceKey: string;
+    doc: string;
+    mids: number[];
+}
 export interface OptimisticBackendOptions {
     /** Stable per-client identity for the upstream envelopes (§8.1). */
     clientID: string;
@@ -93,6 +297,23 @@ export interface OptimisticBackendOptions {
     /** Virtual-clock seam for the fold debounce timers (FOLDED-MUTATIONS-DESIGN §9). Defaults to
      *  real `setTimeout`/`clearTimeout`/`Date.now`; the fold oracle injects a deterministic clock. */
     clock?: FoldClock;
+    /** The explicit confirming-stream OVERRIDE (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1 /
+     *  §3). Since H-iii the live default is the §3 prove-or-slow-path DERIVATION
+     *  ({@link OptimisticBackend.deriveDomain}): a configured policy returning a string pins that
+     *  domain VERBATIM — no proof runs (the test suites and the dual-source e2e pin by name);
+     *  returning `undefined` (or configuring no policy) derives the domain from the prediction run's
+     *  write/read capture against the connected room gates' routing table. With no room gate
+     *  connected the derivation short-circuits to `"daemon"` — every single-domain app is
+     *  byte-for-byte as before. */
+    domainPolicy?: (name: string, args: unknown) => string | undefined;
+    /** A FINAL (authz/validation) mutation rejection's reason surface — the room plane's twin of the
+     *  HTTP mutate route's `onRejected` (H-v; the H-iv-b `mutationOutcome {kind:"rejected"}` frame).
+     *  The prediction's snap-back is NOT this callback's job: the room burns the mid and its lmid
+     *  release drops the entry exactly as a daemon-path rejection does (processed-as-no-op) — this
+     *  is where the REASON reaches the app, same contract as the queue's callback. Also invoked when
+     *  a DEOPT's fresh re-invocation (the already-retired arm) throws — that mutation is dead on the
+     *  current base with no stream left to confirm it, the closest thing to a rejection there is. */
+    onRejected?: (envelope: MutationEnvelope, reason: string) => void;
 }
 /** One folded entry's debounce window, for the timeline's fold drill-down (§4.1). */
 export interface FoldInspect {
@@ -115,6 +336,13 @@ export interface PendingInspect {
     args: unknown;
     /** Tables this mutator touched at its last (re)invocation — the pending-axis basis (§7.2). */
     tables: string[];
+    /** The pk-granular write-set captured at this entry's LAST invocation (RINDLE-REALTIME-QUERY-
+     *  ENABLEMENT-DESIGN.md §3.2 #1), flattened from the {@link WriteSet} map for inspection — one
+     *  entry per `(table, pk)` currently held. Pure capture; no routing consumer yet. */
+    writes: WriteRecord[];
+    /** The read-log captured at this entry's LAST *recorded* invocation (§3.2 #2). Empty for a
+     *  folded entry — the read TRAP arms there, not recording (see {@link PendingMutation.reads}). */
+    reads: ReadLog;
     /** Present iff this entry is a folded (debounced) write. */
     fold?: FoldInspect;
 }
@@ -156,6 +384,9 @@ export declare class OptimisticBackend<S extends ColsMap> implements Backend {
      *  its width check. */
     private readonly colCounts;
     private readonly colIndex;
+    /** Per-table pk column indices — held so `connectSource` can build a fresh per-source
+     *  `NormalizedSync` with the same layout the daemon's uses. */
+    private readonly pkCols;
     /** The client's OWN typed per-table schemas + the reserved lmid table — the fixed base
      *  of the expected-schema set (CRIT#4 validation). Synthetic agg tables are appended as
      *  queries arrive (`ensureSyntheticTables`). */
@@ -174,6 +405,13 @@ export declare class OptimisticBackend<S extends ColsMap> implements Backend {
      *  pending delta `displayed = server_base ⊕ local_pending_delta` is applied from. */
     private readonly overlay;
     private handler;
+    private catchUpQids;
+    /** Newly-hydrated qids whose reconcile ACTUALLY emitted a (catch-up-stamped) batch — recorded by the
+     *  local-event forwarder alongside {@link catchUpQids}. After the reconcile, any newly-hydrated qid
+     *  NOT in here folded nothing (0 rows, or its result already present via a sibling → 0 net muts, or
+     *  the reconcile was skipped), so `onProgress` sends it an explicit empty catch-up — else its SSR
+     *  seed would never retire (the view freezes). Non-null only for the reconcile's duration. */
+    private catchUpEmitted;
     /** The Store's commit-boundary handler ({@link Backend.onCommitBoundary}), forwarded from the
      *  local engine's `dispatch` brackets so the Store folds every affected view before notifying any
      *  subscriber (cross-view-atomic notification). All this backend's data deltas originate from the
@@ -181,18 +419,139 @@ export declare class OptimisticBackend<S extends ColsMap> implements Backend {
     private boundaryHandler;
     private readonly devObservers;
     private pendingMutations;
+    /** The next mid to deal, PER DOMAIN (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1): a client
+     *  writing through room + daemon concurrently must not alias one lmid counter. Seeded with the
+     *  `"daemon"` stream at 1; a domain absent from the map starts at 1. In the single-domain
+     *  configuration only `"daemon"` is ever touched, so the sequence is byte-for-byte as before. */
     private nextMid;
+    /** The client-global deal counter behind {@link PendingMutation.seq}: one sequence across ALL
+     *  domains, bumped whenever any domain's mid is dealt. The replay order (mids are per-domain and
+     *  incomparable across domains — see the `seq` field doc). */
+    private dealSeq;
+    /** The explicit confirming-stream override (§7.1/§3) — see
+     *  {@link OptimisticBackendOptions.domainPolicy}. `undefined` from it ⇒ H-iii derivation. */
+    private readonly domainPolicy;
+    /** The final-rejection reason surface ({@link OptimisticBackendOptions.onRejected}). */
+    private readonly rejectedHandler;
+    /** Processed `(domain, mid)` outcome frames (H-v) — the deopt handshake's idempotence guard: a
+     *  duplicate frame (the original plus a reconnect re-send's re-answer, or two re-answers across
+     *  two reconnects) must not double-invoke. Needed precisely because a deopt frame can arrive for
+     *  an ALREADY-RETIRED mid (the replay gotcha) — "no matching entry" alone cannot distinguish
+     *  "handle it fresh" from "already handled". Per-domain FIFO, capped like the shell's
+     *  recorded-outcome map ({@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}); past the cap a duplicate of
+     *  an evicted mid would be re-processed — the same bounded-window trade the shell makes, and it
+     *  takes 512 interleaving non-applied outcomes on one domain to open it. */
+    private readonly outcomesProcessed;
+    /** THE routing table (H-iii §3): per connected room `sourceKey` → per promoted table → its
+     *  client-held {@link RoomTableRouting}. Written ONLY by {@link promoteRoomTable} (same breath
+     *  as the engine attach + {@link promotedTables}); read by {@link deriveDomain} and — via
+     *  {@link roomTablesFor} — the client's `__realtimeInspect` bookkeeping. */
+    private readonly roomRouting;
+    /** Q6 counters ({@link RoutingInspect}): successful derivations per room. */
+    private readonly routingDerived;
+    /** Q6 counters ({@link RoutingInspect}): derivation failures per {@link RoutingFailureReason}. */
+    private readonly routingReasons;
     /** The live fold entries, by fold key `${name}\0${identityJSON}` — at most one per key
      *  (FOLDED-MUTATIONS-DESIGN §8). Insertion order is creation order (the drain/flush tiebreak). */
     private readonly folds;
     /** The fold debounce clock (real timers by default; the oracle injects a virtual one). */
     private readonly clock;
-    /** The high-water confirmed mutation id, folded from the lmid system query's
-     *  RELEASED ops (lmid-as-data) — never from a frame. */
-    private confirmedLmid;
-    private buffer;
-    private nextSeq;
-    private appliedCv;
+    /** The high-water confirmed mutation id, PER DOMAIN (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md
+     *  §7.2 per-domain confirm-drop): an entry with `mid <= watermark[entry.domain]` has been
+     *  confirmed. The `"daemon"` domain is folded from the lmid system query's RELEASED ops
+     *  (lmid-as-data) — never from a frame; a room domain will fold from its own lmid stream (later
+     *  slice). Seeded with `"daemon"` at 0; the daemon scalar `confirmedLmid` (devtools) is
+     *  `watermark.get("daemon")`. */
+    private watermark;
+    /** The per-source coherence gates (§5.1), by source key. Seeded with the daemon gate at
+     *  construction; a room channel attaches later (`connectSource`). Single-domain: one entry,
+     *  and every gate-generalized path degenerates to the old single-buffer code. NOT the same
+     *  space as {@link watermark}/{@link nextMid}: a DOMAIN can confirm with no gate connected
+     *  (the `__testRelease` seam); a gate's `key` names the domain its lmid stream folds into. */
+    private readonly gates;
+    /** The daemon's gate — the always-present channel (constructor-attached). The devtools
+     *  scalars (`__inspect`) read it directly; its `sync` IS {@link sync} (the agg overlay and
+     *  synthetic tables are daemon-tracked by design). */
+    private readonly daemonGate;
+    /** Tables promoted to a MERGED multi-source engine (a room source attached). Written by the one
+     *  promotion seam ({@link promoteRoomTable}; the test-named {@link __addRoomSource} and Slice
+     *  G-v's lease-driven promotion from `RoomTableSpec[]` both flow through it). Read by the §7.3
+     *  hold-back trigger in
+     *  {@link applyRelease}: parking on a never-promoted (Collapsed) table is SKIPPED — inert anyway
+     *  today (`rewind_collapsed` never consults `held_back`), and a live hazard if the table later
+     *  promotes (a stale Collapsed-era entry turns overlay-first-visible and pins forever). Slice H's
+     *  prove-or-slow-path routing keeps the real scenario — a room-confirmed mutation writing a
+     *  Collapsed table — impossible; this gate covers the window until then. */
+    private readonly promotedTables;
+    /** The §301 pin registry ({@link EchoFencePin}): every parked §7.3 hold-back's delivery-fence
+     *  inputs, keyed `${table}\0${sourceKey}\0${pkKey}`. Written in the same breath as the
+     *  `holdBack`/`holdBackAbsent` park; read by {@link dropEchoFencePins} at the tail of every
+     *  release. Empty on every single-domain client — the drop pass is then a structural no-op. */
+    private readonly pins;
+    /** The §301 direction-A fence input: per room domain, the highest lmid the DAEMON-CARRIED
+     *  ledger rows have folded ({@link foldSystemFrames} step 2 — and ONLY that path: the room
+     *  socket's own lmid stream confirms long before the flush reaches the daemon, so it folds
+     *  into the shared {@link watermark} but never here, 301 §1.1). When this covers a pin's mid,
+     *  the same coherent release (or an earlier one) folded the flush data that carried it into
+     *  the daemon baseline — the fence. */
+    private readonly daemonCarriedLmid;
+    /** The §301 §2.4 boot rule's inputs: the daemon boot ids this client has OBSERVED, in order
+     *  (id → ordinal), plus the current one. Boot ids are opaque — ordering is the client's own
+     *  observation ({@link OptimisticSource.onBootId} on the daemon gate). Direction-B pins stamp
+     *  the current boot; a room advertising a LATER-observed boot proves absorption (its
+     *  re-snapshot came from a daemon state that durably includes the confirmed write). */
+    private readonly daemonBootOrdinals;
+    private daemonBootId;
+    /** The per-read provenance probe `invoke` hands `trackingTx` when recording is armed (H-ii,
+     *  §3.2 #3): the engine's `provenanceOf` — the VISIBLE overlay-first winner for the row's pk,
+     *  read from LIVE pre-commit state (an open txn's staged writes are not consulted; H-i). Gated
+     *  on PER-TABLE {@link promotedTables} membership — the cheapest existing signal, and the
+     *  correct one: provenance is an ENGINE-merge question, not a channel question ({@link gates}
+     *  can hold a connected-but-unpromoted room feed, and the oracle harness promotes with no gate),
+     *  and a never-promoted (Collapsed) table is daemon-owned by construction. So a pure
+     *  single-domain app pays ZERO wasm calls per recorded read; the recorded `source` is then
+     *  `undefined`, which is also correct — everything is daemon-owned (see {@link ReadRecord}). */
+    private readonly readProvenance;
+    /** System retains by source qid ({@link retainSystemQuery}): a subscription with NO store view
+     *  and NO user-visible table — its frames buffer on its gate exactly like {@link LMID_QID}'s and
+     *  fold at RELEASE time ({@link foldSystemFrames}), never entering the sync layer or the local
+     *  engine. The spec names which system table the qid serves and the scope/doc it was minted for
+     *  (the fold's row filter). Empty on every non-lifecycle client — every partition below is then
+     *  a structural no-op and the release path is byte-identical to before. */
+    private readonly systemQids;
+    /** The §4.2 fence state: room doc → highest `flush_seq` delivered through the daemon plane
+     *  (monotone max-fold; a remove never regresses it). Slice I-v's ghost-drop consumer — I-iii
+     *  only maintains + exposes it (`__inspectDomains().lifecycle`). */
+    private readonly roomWatermarks;
+    /** The §4.1 occupancy state: scope → (client_id → expires_at) from the doorbell stream. Slice
+     *  I-iv's doorbell consumer (the 1→2 re-lease reaction) — I-iii only maintains + exposes it.
+     *  A snapshot REPLACES the scope's map (authoritative re-hydrate); a batch folds add/edit/remove
+     *  incrementally (the age-out sweep's deletes arrive as removes). */
+    private readonly scopeSessions;
+    /** The I-iv doorbell event sink ({@link onScopeSessions}) — fired once per scope a release's
+     *  scope-session fold touched, AFTER the whole release applied. Default no-op: a client that
+     *  never registers (no lifecycle plane) pays nothing. */
+    private scopeSessionsHandler;
+    /** Deferred old-channel row GC for in-flight upgrade retargets ({@link retargetRemoteQuery}):
+     *  sub sourceQid → the channel it left. The rows the OLD gate's sync holds for the qid stay
+     *  visible (merge: daemon tier) until the sub's first snapshot RELEASES on its new room channel
+     *  ({@link flushRetargetGc}) — dropping them at retarget time would emit net removes ahead of
+     *  the room's re-adds, the flicker the two-phase cutover exists to avoid. Doubles as the
+     *  wrong-channel GRACE window in {@link onFrame}: a frame already in flight from the old
+     *  channel when the sub moved is stale, not a wiring bug. Empty on every non-upgrade client —
+     *  every consultation below is then a structural no-op. */
+    private readonly pendingRetargetGc;
+    /** The §4.2 GHOSTS (Slice I-v): demoted room sources awaiting their watermark fence, by
+     *  sourceKey. Written only by {@link demoteRoomSource}; evaluated after every release
+     *  ({@link evaluateGhosts}) and dropped by {@link dropGhost} once the fence clears with no
+     *  sent room-domain pending left. Empty on every non-downgrade client — the per-release
+     *  evaluation is then a structural no-op. */
+    private readonly ghosts;
+    /** The I-v stuck-downgrade surface ({@link onDowngradeStuck}) — fired AT MOST ONCE per ghost
+     *  when its fence is satisfied but sent room-domain mids remain unresolved (§7.5: they retire
+     *  only through outcome resolution; the ghost holds rather than inventing a timeout-retire).
+     *  Default no-op. */
+    private downgradeStuckHandler;
     private readonly asts;
     /** Per query: the base tables its result can draw from (from the AST tree). */
     private readonly queryTables;
@@ -210,8 +569,32 @@ export declare class OptimisticBackend<S extends ColsMap> implements Backend {
      *  touches its tables. Cached so `onPending` fires only on transitions (invoke ↔ confirm). */
     private readonly pendingState;
     private pendingHandler;
+    /** The local-persistence write-through tap (`207-LOCAL-TABLE-PERSISTENCE-DESIGN.md` §5.1):
+     *  {@link writeLocal} invokes it post-commit; {@link applyLocalReplica} deliberately does not. */
+    private localWriteObserver;
     constructor(schema: Schema<S>, source: OptimisticSource, registry: ClientRegistry, opts: OptimisticBackendOptions);
-    registerQuery(qid: QueryId, ast: Ast, remote?: RemoteQuery): void;
+    /** Wire one authority channel into its own coherence gate (§5.1): every frame the channel
+     *  delivers buffers on THIS gate's cv timeline, its progress frames release THIS buffer, its
+     *  restart resets THIS gate alone, and its reserved lmid stream folds into `watermark[key]`.
+     *  Validates each server hello against our OWN typed schema → reject a schema skew (CRIT#4);
+     *  the reserved lmid table is part of the expected set so the system query's hello passes, and
+     *  synthetic agg tables join the set as queries register them. */
+    private attachGate;
+    /** Attach a SECOND authority channel (§5.1) — the seam Slice G's room upgrade calls with the
+     *  ws-backed room feed. Rooms speak the daemon protocol verbatim (§2.4: the client cannot tell
+     *  a room from the daemon), so the argument is a full {@link OptimisticSource} — exactly what
+     *  `@rindle/remote` builds from `{roomUrl, leaseToken}`. The channel buffers/releases on its
+     *  own cv timeline (an independent §5.1 gate: coherent within, eventual across) and its
+     *  reserved lmid stream folds into `watermark[sourceKey]` — so `sourceKey` must equal the
+     *  `domainPolicy` name for the mutations this authority confirms. The converse is NOT required:
+     *  a domain may exist with no connected gate (`__testRelease` drives confirms gate-less); the
+     *  live production path stays daemon-only until G calls this. */
+    connectSource(sourceKey: string, source: OptimisticSource): void;
+    /** `channel` (G-iii registration-time routing) names the authority channel the remote sub
+     *  registers on — a `connectSource`d gate key; default `"daemon"` (every existing caller is
+     *  byte-identical). Slice G-v threads the lease's `realtime.sourceKey` here. Validated FIRST
+     *  (like the E3 check below): a bad channel must throw before any per-query state is recorded. */
+    registerQuery(qid: QueryId, ast: Ast, remote?: RemoteQuery, channel?: string): void;
     /** Register every synthetic aggregate table `ast` needs that we haven't seen yet: on the
      *  local engine (which auto-tracks it for the optimistic rebase loop), on `NormalizedSync`
      *  (so its rows refcount/GC by group key), and into the source's expected-schema set (so
@@ -225,8 +608,145 @@ export declare class OptimisticBackend<S extends ColsMap> implements Backend {
      *  `unregisterTable` frees it (the engine refuses otherwise). */
     private releaseSyntheticTables;
     unregisterQuery(qid: QueryId): void;
-    retainRemoteQuery(qid: QueryId, remote: RemoteQuery, localQueryId?: QueryId, ast?: Ast): void;
+    /** `channel` as in {@link registerQuery} (G-iii): the gate the remote sub registers on; default
+     *  `"daemon"`. This is the split-retain seam G-v's resolve-then-register drives — resolve the
+     *  lease, learn `realtime.sourceKey`, `connectSource` it, then retain the query on that channel.
+     *  Validated FIRST so a bad channel throws before any synthetic-table refcount moves. */
+    retainRemoteQuery(qid: QueryId, remote: RemoteQuery, localQueryId?: QueryId, ast?: Ast, channel?: string): void;
     releaseRemoteQuery(qid: QueryId): void;
+    /** The Slice I-iv upgrade retarget (§4.1 "Retarget" / the doorbell reaction): move a LIVE
+     *  (name, args) sub — every retain of it and every local view it feeds, wholesale — from the
+     *  channel it lives on onto `sourceKey`'s (already-`connectSource`d, already-promoted) room
+     *  channel, WITHOUT the view ever dropping its rows. Returns the sub's wire `sourceQid` (the
+     *  identity the client's renewal loop re-subscribes with).
+     *
+     *  Why a dedicated primitive: the one-channel-per-(name,args) invariant ({@link retainRemote}'s
+     *  loud throw) is correct — a sub's frames must never split across two cv timelines — so the
+     *  upgrade cannot simply retain a second sub on the room and release the daemon one; and the
+     *  naive release-then-retain order GCs the daemon sync's rows synchronously (net removes emit,
+     *  the view flashes empty) a full ws round trip before the room's seq-0 snapshot refills it.
+     *  The cutover is therefore TWO-PHASE around the room's first release:
+     *
+     *   1. NOW (here): unsubscribe the old channel's wire sub, sweep its still-buffered frames for
+     *      this qid (their cv timeline continues without the sub — the hello-supersession
+     *      precedent), flip `sub.channel`, re-arm `sub.hydrated` (the room's own snapshot is the
+     *      cutover point), and register on the room source (its resolver presents the handed
+     *      roomToken). The old gate's SYNC rows are deliberately NOT dropped: they keep the view's
+     *      rows visible through the window (merge: the daemon-tier holder). Local views keep their
+     *      `hydrated` membership — the view stays `complete` on its authoritative daemon rows.
+     *   2. AT THE ROOM'S FIRST RELEASED SNAPSHOT ({@link flushRetargetGc}): the room source now
+     *      holds the footprint rows (folded via `serverBatchBegin(sourceKey)` — value-equal rows
+     *      re-hydrate as a net-zero diff, RT §3.4 per channel), so the deferred
+     *      `dropQuery`+reconcile on the OLD gate flips each pk's winner daemon→room value-equal:
+     *      net-zero again. No emission carries a disappearance at any point.
+     *
+     *  Idempotent per target channel: a sub already on `sourceKey` returns immediately (the
+     *  double-doorbell / re-entrancy guard — one retarget per (query, sourceKey), mirroring
+     *  {@link promoteRoomTable}'s caller-side per-(sourceKey, table) idempotence). Validates before
+     *  mutating: a throw here leaves the sub fully daemon-attached (the client's fail-open). */
+    retargetRemoteQuery(remote: RemoteQuery, sourceKey: string): QueryId;
+    /** Phase 2 of {@link retargetRemoteQuery}, run at the end of every gate release: once a
+     *  retargeted sub's first snapshot has RELEASED on its new channel (`sub.hydrated` re-armed at
+     *  retarget, re-set by {@link markSubHydrated} inside this very release), drop the qid's rows
+     *  from the OLD gate's sync and reconcile them out — after the room's rows are already applied,
+     *  so the winner flip is value-equal (net-zero; see the phase table above). A sub torn down
+     *  mid-window was already swept by `releaseRemoteQuery`/`unregisterQuery` (which delete the
+     *  record); a vanished record here is pruned defensively. */
+    private flushRetargetGc;
+    /** The I-v downgrade orchestration primitive (§4.2/§7.4): retire room `sourceKey` behind the
+     *  watermark fence. The caller has ALREADY retargeted every live sub off the channel
+     *  ({@link retargetRemoteQuery} room→daemon — validated loudly below) and holds the fence from
+     *  the api-server's downgrade response (`finalFlushSeq` = the room's last COMMITTED flush seq;
+     *  `doc` keys the §4.2 watermark fold, {@link roomWatermarks}). Steps, in order:
+     *
+     *   1. **De-candidacy NOW**: the sourceKey's {@link roomRouting} entries are removed, so
+     *      {@link deriveDomain} stops proposing the room (zero candidates ⇒ `"daemon"`). Unsent
+     *      pending (`mid === null`) re-routes for free — a fold's flush re-derives from the live
+     *      candidate set (§7.5 rule 1). The engine's frozen scope still ANSWERS (`writableMatches`
+     *      / `provenanceOf` — freezing gates serving, not the scope definition); routing is
+     *      TS-gated here.
+     *   2. **Freeze** the WRITABLE promoted tables (`freezeSource`): the room slice becomes the
+     *      §4.2 ghost — wins-if-present in the merge (D4), so its rows (at-or-ahead of the daemon
+     *      until the flush echoes) stay visible while the slice accepts nothing. Context tables
+     *      (`writable: false`) are deliberately NOT frozen: the daemon is authoritative for them
+     *      LIVE (§5.2's context tier) and freezing would invert that, pinning a possibly-BEHIND
+     *      relayed copy over fresher daemon rows; unfrozen they keep exactly the live tiering.
+     *   3. **Disconnect** the channel ({@link disconnectSource}): handlers detached, gate + buffer
+     *      dropped. `nextMid`/`watermark`/processed-outcomes for the domain are KEPT FOREVER (§7.1:
+     *      an assigned mid pins its domain; a later re-upgrade of the same doc continues the
+     *      sequence — {@link connectSource} attaches a fresh gate and the lmid snapshot max-folds
+     *      into the surviving watermark). Disconnecting BEFORE the daemon sub's first release is
+     *      load-bearing: it makes {@link flushRetargetGc}'s deferred old-channel GC a no-op (gate
+     *      gone ⇒ record deleted, nothing dropped) — running that GC would rewind the room slice's
+     *      rows at daemon hydration, i.e. BEFORE the fence, surfacing a lagging follower's stale
+     *      images (the exact regression §4.2 exists to prevent). The ghost's rows leave only
+     *      through {@link dropGhost}'s `removeRoomSource`, value-equal under the fence.
+     *   4. **Ghost + first evaluation**: the record joins {@link ghosts} and is evaluated once
+     *      immediately — `finalFlushSeq === 0` (a never-flushed room) with no room-domain pending
+     *      drops on the spot, the single-daemon first-frame case.
+     *
+     *  In-flight discipline (§7.5): entries with `mid !== null` on `sourceKey` stay PINNED (rule
+     *  2 — never re-route a sent mutation); their resolution arrives via the daemon-carried
+     *  ledger+outcome folds (I-iii) and blocks the drop until then. Idempotent per sourceKey (a
+     *  second labeled query sharing the room demotes into the existing ghost). */
+    demoteRoomSource(sourceKey: string, doc: string, finalFlushSeq: number): void;
+    /** Detach one connected room channel (Slice I-v step 3): the source's handlers are replaced
+     *  with no-ops (the {@link OptimisticSource} handler seam is single-registration, so this IS
+     *  the detach — a late frame from a dying socket can no longer touch any bookkeeping), its
+     *  reserved lmid sub is unregistered, and the gate — buffer, per-source sync, cv watermark —
+     *  is dropped from {@link gates}. The DOMAIN state deliberately survives forever:
+     *  `nextMid[sourceKey]`, `watermark[sourceKey]`, and the processed-outcome set are untouched
+     *  (§7.1 — an assigned mid pins its domain; a re-upgrade must continue, never restart, the mid
+     *  sequence; {@link connectSource} then attaches a fresh gate whose lmid snapshot max-folds
+     *  into the surviving watermark via {@link foldConfirm}). Closing the underlying transport is
+     *  the caller's job. Idempotent (a missing gate is a no-op). */
+    disconnectSource(sourceKey: string): void;
+    /** Register the I-v stuck-downgrade sink — see {@link DowngradeStuckEvent}. One handler (a
+     *  later registration replaces it, the {@link onScopeSessions} convention); client.ts maps it
+     *  onto the loud anomaly surface. */
+    onDowngradeStuck(handler: (event: DowngradeStuckEvent) => void): void;
+    /** The I-v ghost-drop watcher (§4.2), run after every applied release ({@link applyRelease} —
+     *  the seam where {@link roomWatermarks} has just folded and the confirm-drop has just run) and
+     *  once at demote time. For each ghost: the fence must be satisfied
+     *  (`roomWatermarks[doc] ≥ finalFlushSeq`; 0 is trivially satisfied) AND no SENT room-domain
+     *  pending may remain (§7.5 — such entries resolve only through the daemon-carried
+     *  outcome/ledger folds; an entry that never reached the room is undecidable, so the ghost
+     *  HOLDS and the stuck event fires exactly once, naming the mids). Both satisfied ⇒
+     *  {@link dropGhost}. */
+    private evaluateGhosts;
+    /** Drop one cleared ghost (§4.2 end state): detach every promoted table's room source (D2
+     *  stay-merged — `removeRoomSource` reconciles each held pk to daemon-or-vanish, value-equal
+     *  under the fence, so visually a no-op), release the {@link promotedTables} record for tables
+     *  no OTHER room/ghost still holds, then run ONE daemon reconcile so entries whose writes had
+     *  staged onto the ghost slice re-invoke and re-stage by provenance onto the daemon slice (the
+     *  removal took their staged copies with the tree; provenance now answers daemon). The whole
+     *  drop runs under one commit boundary so the removal's compensating deltas and the re-staged
+     *  predictions notify as ONE step. After this, a FUTURE upgrade of the same doc promotes
+     *  again from scratch — the round trip is pinned by the §8.5 lanes. */
+    private dropGhost;
+    /** Retain one minted SYSTEM subscription (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §4, Slice
+     *  I-iii): a wire sub with NO store view and NO user-visible table. Registered through the same
+     *  {@link RemoteSub} bookkeeping as any remote retain — so qid→channel ownership, the overflow
+     *  re-subscribe, and refcounted release all work unchanged — but with an EMPTY `localQids` set
+     *  (no hydration/resultType coupling) and a {@link systemQids} record telling the release path
+     *  which system table this qid's frames carry (`spec.table`) and which scope/doc it was minted
+     *  for (the fold's row filter). Its frames then buffer on the channel's gate exactly like
+     *  {@link LMID_QID}'s and fold at RELEASE time in {@link foldSystemFrames} — riding the SAME
+     *  buffered cv path as the data they co-committed with (fence coherence: an out-of-band
+     *  shortcut would break I-ii's co-commit ordering guarantee).
+     *
+     *  `channel` defaults to `"daemon"` — the system tables live in the DAEMON store (that is the
+     *  point: outcome/ledger/watermark rows must be readable with no room socket alive, §7.1
+     *  "load-bearing for §7.5"). Idempotence per (table, scope/doc) is the CALLER's job (client.ts
+     *  keys its retains on exactly that); a duplicate retain of the SAME remote identity refcounts
+     *  like any sub. */
+    retainSystemQuery(retainQid: QueryId, remote: RemoteQuery, spec: SystemStreamSpec, channel?: string): void;
+    /** Release a {@link retainSystemQuery} retain. Refcounted like any sub; the LAST release
+     *  unregisters from the owning channel, sweeps its buffered frames, and drops the
+     *  {@link systemQids} record. The folded lifecycle STATE (`roomWatermarks`/`scopeSessions`/
+     *  processed outcomes) deliberately survives — the fence is monotone truth about the store, not
+     *  about the subscription (a re-retained fence must not forget a cleared watermark). */
+    releaseSystemQuery(retainQid: QueryId): void;
     /** Raw CRUD has no optimistic story (§9 replaces it with named mutators). Register a
      *  mutator — even a trivial one — and `invoke` it. */
     mutate(_mutations: Mutation[]): Promise<void>;
@@ -234,8 +754,26 @@ export declare class OptimisticBackend<S extends ColsMap> implements Backend {
      *  straight to the local engine, OUTSIDE the optimistic pending stack — a local table is
      *  untracked, so it never rebases, reverts, or waits on a confirmation. Rejects a synced/tracked
      *  table (the local engine's `writeLocal` is the chokepoint). Reconcile is synchronous and
-     *  non-reentrant (A5), so a local write can never interleave with an open server cycle. */
+     *  non-reentrant (A5), so a local write can never interleave with an open server cycle.
+     *
+     *  Fires the {@link onLocalWrite} observer AFTER the engine commit but BEFORE subscriber
+     *  delivery — i.e. for exactly the batches that passed the M2 guard and committed (the
+     *  persistence layer's write-through tap, `207-LOCAL-TABLE-PERSISTENCE-DESIGN.md` §5.1). A
+     *  subscriber throwing during delivery re-raises out of this call, but only after the tap has
+     *  seen the batch: a committed write can never be invisible to the persistence plane. */
     writeLocal(mutations: Mutation[]): void;
+    /** The write-through tap for the local-persistence layer (207 §5.1): `observer` sees every
+     *  {@link writeLocal} batch post-commit. One observer (the layer); a later registration
+     *  replaces it. The observer must not throw — a persistence failure degrades durability, never
+     *  the write path (P9); the layer catches internally. */
+    onLocalWrite(observer: (mutations: Mutation[]) => void): void;
+    /** Apply a REPLICATED local batch (a restore snapshot / a leader `commit` — 207 §5.1): delegates
+     *  to the engine's `writeLocal`, so the M2 locality guard still fires (P8 — a corrupt record
+     *  naming a synced table dies loudly here), but does NOT invoke the {@link onLocalWrite}
+     *  observer — the echo guard is structural, so the persistence layer can never re-enter itself.
+     *  `onCommitted` fires post-commit pre-delivery (same anchor as {@link writeLocal}'s tap): the
+     *  layer updates its mirror there, so a subscriber throw can never desync mirror from engine. */
+    applyLocalReplica(mutations: Mutation[], onCommitted?: () => void): void;
     onEvent(handler: (qid: QueryId, ev: ChangeEvent) => void): void;
     onCommitBoundary(handler: (phase: "begin" | "end") => void): void;
     /** Bracket a multi-step optimistic apply as ONE notification commit (cross-view-atomic
@@ -254,10 +792,51 @@ export declare class OptimisticBackend<S extends ColsMap> implements Backend {
      *  state (read-your-writes), the SAME body the API server drives asynchronously. `ctx.user` is
      *  the acting principal (re-read per invoke, stable across a rebase re-invoke). */
     private runMutator;
+    /** Deal the next wire mid from `domain`'s ledger (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md
+     *  §7.1) and advance that counter. A domain absent from the map starts at 1. Per-domain, so a
+     *  client writing through room + daemon concurrently keeps two gapless, non-aliasing sequences.
+     *  The client-global `seq` is stamped in the same breath — the ONE cross-domain total order
+     *  (confirmation order is per-domain; replay order is client-global). Bundled here so no call
+     *  site can deal a mid without its seq. ONE caller discards the seq deliberately: the H-v deopt
+     *  flip ({@link handleMutationOutcome}) keeps the entry's ORIGINAL seq — its replay position —
+     *  and takes only the fresh mid (the dealSeq bump is harmless: seq consumers order, never
+     *  count). */
+    private dealMid;
+    /** The route decision for one invocation (invoke, and again at fold flush): the explicit
+     *  `domainPolicy` is the OVERRIDE — a string pins that domain verbatim, no proof runs;
+     *  `undefined` (or no policy configured) derives per §3. */
+    private resolveDomain;
+    /** §9.3: does this fold's write-set route into a room (vs the daemon)? Used ONLY to pick the
+     *  {@link FoldOptions.roomDebounceMs} cadence at a fold window's start. It probes
+     *  {@link resolveDomain} but RESTORES the Q6 routing diagnostics afterward — the authoritative
+     *  route and its single counter bump belong to the flush ({@link flushFold}), not to this
+     *  interval hint. A fold's reads are provably empty (the read-trap arms on that path), so the
+     *  write-set alone decides. */
+    private routesToRoom;
+    /** Count one derivation failure ({@link RoutingInspect}). Returns `false` so the per-candidate
+     *  proof's call sites read `return this.failDerivation(...)`. */
+    private failDerivation;
+    /** The §3 derivation. Candidates are the connected room gates with at least one promoted table
+     *  (a promoted table with no gate cannot confirm; a gate with no promoted table holds no data to
+     *  prove against). Zero candidates ⇒ `"daemon"` (the single-domain fast path). The proof runs
+     *  per candidate and EXACTLY ONE must survive — two rooms both proving routes slow (principled
+     *  disambiguation is a §9.2 multi-room NON-goal, deferred past Slice J; slow is always sound). */
+    private deriveDomain;
+    /** One candidate room's §3 proof over the captured write-set + read-log. Every write must pass
+     *  ALL the write rules; every read must pass ONE of the read rules. First failure wins (and is
+     *  counted); order is deterministic (write-set map order, then read-log order). */
+    private provesRoom;
     /** Run the named client mutator optimistically: the prediction applies to the live
      *  engine now (affected views update synchronously), `(mid, name, args)` joins the
      *  pending stack, and the envelope ships upstream. Returns the assigned `mid`. */
     invoke(name: string, args: unknown): number;
+    /** {@link invoke} with an optional PINNED confirming domain (H-v): the deopt handshake's
+     *  already-retired arm re-invokes the frame's echoed `(name, args)` as a FRESH invocation pinned
+     *  to `"daemon"` — an honest re-prediction on the current base, never derived (`pin` bypasses
+     *  {@link resolveDomain} entirely, so the router never runs and no Q6 counter moves). Every
+     *  other step is `invoke` verbatim: prediction now, capture, drainOverlapping, mid dealt from
+     *  the pinned domain's ledger, envelope on its channel. */
+    private invokeWith;
     /** Run a FOLDED invoke (FOLDED-MUTATIONS-DESIGN §8): apply the prediction to the live engine now
      *  (like `invoke`), but collapse a run of same-key invokes into ONE pending entry whose `args`
      *  are overwritten in place, debounce the server write, and ship only the last value. The `mid`
@@ -272,6 +851,66 @@ export declare class OptimisticBackend<S extends ColsMap> implements Backend {
      *  by construction), stamp the entry, ship the envelope with the LATEST args, resolve the handle.
      *  The entry stays on `pendingMutations` (now with a real mid) until the lmid release confirms it. */
     private flushFold;
+    /** The transport a `domain`-confirmed mutation ships on (§7.5 sent-pins-domain: only the
+     *  domain's own authority can confirm it, so its channel is the only correct transport). A
+     *  domain with NO connected gate ships on the daemon channel — the gate-less configurations
+     *  (`__testRelease`-driven tests) and today's entire live path resolve `"daemon"` anyway. */
+    private channelFor;
+    /** The gate a channel-keyed retain registers through (G-iii registration-time routing). The
+     *  channel MUST already be connected (`connectSource`; the daemon is constructor-attached) —
+     *  loud by design: a typo'd or not-yet-connected sourceKey must throw at retain time, never
+     *  silently register on the daemon and split the query's frames across channels. */
+    private requireGate;
+    /** The channel that owns `sourceQid` — {@link RemoteSub.channel}, the ONE source of truth for
+     *  qid routing (G-iii). `undefined` when no sub owns the qid (a harness-delivered raw feed, or
+     *  a just-released sub): such frames buffer on whatever gate they arrive at. */
+    private channelOf;
+    /** Record `(domain, mid)` as processed; `false` if it already was (a duplicate frame —
+     *  ignore it). FIFO-capped per domain ({@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}). */
+    private markOutcomeProcessed;
+    /** One `mutationOutcome` frame from `domain`'s channel (H-v — the §3.3 handshake's client
+     *  half). The frame arrives OUT-OF-BAND (see {@link attachGate}); the state machine:
+     *
+     *  1. `mid` never issued on `domain` ⇒ ignore (a confused/foreign frame must not invent work).
+     *  2. `(domain, mid)` already processed ⇒ ignore — idempotence under duplicate frames (the
+     *     original + a re-send's re-answer; a deopt for a mid whose entry ALREADY FLIPPED also
+     *     lands here harmlessly on its second frame).
+     *  3. `kind:"rejected"` ⇒ FINAL. Surface the reason through {@link rejectedHandler} (room-plane
+     *     parity with the HTTP queue's callback) and STOP — the drop + snap-back is the EXISTING
+     *     failed-mutation machinery: the room burnt the mid, its lmid release retires the entry
+     *     per-domain and the reconcile rewinds the prediction, exactly the daemon path's
+     *     processed-as-no-op rejection. No new drop path.
+     *  4. `kind:"deopt"`, entry found (pending `(domain, mid)`) ⇒ FLIP IN PLACE: `domain` becomes
+     *     `"daemon"`, a fresh daemon mid is dealt and the envelope ships NOW on the daemon channel
+     *     ("deal-and-send-now" — the conforming §3.3 re-enqueue: there is no flush machinery for
+     *     non-fold entries, so the design's "mid: null until the daemon flush" is satisfied
+     *     momentarily inside this call). THE ENTRY'S `seq` IS KEPT — settled (§5.3, commit
+     *     68141096): `seq` is the client-global REPLAY order; re-sequencing would move the entry's
+     *     overlay position and change read-dependent SIBLINGS' replay base. Everything else stays
+     *     (writes/reads/touched/touchedSources/writeSources — union-never-shrink), the prediction
+     *     stays applied (the entry never leaves `pendingMutations`, so no rewind fires), and the
+     *     router does NOT re-run nor does `drainOverlapping` (§3.3 re-enqueues, never re-derives;
+     *     any open overlapping fold was invoked later and flushes later with a larger mid).
+     *  5. `kind:"deopt"`, entry NOT found ⇒ the burnt-mid confirm won the race, or the frame is a
+     *     replay re-answer for an entry a previous session retired (the replay gotcha): re-invoke
+     *     the frame's echoed `name`/`args` as a FRESH invocation PINNED to `"daemon"` — an honest
+     *     re-prediction on the current base, never a derived route ({@link invokeWith}). A frame
+     *     without `name` (not self-contained) has nothing to re-invoke and is dropped; a re-invoke
+     *     that THROWS (the base moved from under it) is surfaced through {@link rejectedHandler} —
+     *     the mutation is dead with no stream left to confirm it.
+     *
+     *  A `"deopt"` bump joins the Q6 routing counters either way (`routing.reasons.deopt`) —
+     *  derived-and-deopted routes are visible beside derived successes. */
+    private handleMutationOutcome;
+    /** §7.5 rule 3 (H-v): re-send `domain`'s unconfirmed pending envelopes with their ORIGINAL
+     *  mids, in mid order, on the domain's own channel. Folds with `mid === null` are excluded —
+     *  nothing was ever sent for them (the flush deals their mid). Envelopes are reconstructed from
+     *  the pending entries exactly as `invoke` shipped them (`clientID`/`mid`/`name`/`args` —
+     *  entries carry everything the wire needs). Idempotent under the domain's ledger: an APPLIED
+     *  mid dedups silently and its lmid coverage retires the entry; a NON-APPLIED mid is re-answered
+     *  from the shell's recorded-outcome map into {@link handleMutationOutcome}. Confirmed entries
+     *  are already gone from `pendingMutations`, so no filter against the watermark is needed. */
+    private resendPending;
     /** Drain every outstanding fold immediately (FOLDED-MUTATIONS-DESIGN §3): the explicit
      *  `app.flushFolds()` and the `beforeunload`/`close` hook. Creation (insertion) order. */
     flushFolds(): void;
@@ -304,17 +943,213 @@ export declare class OptimisticBackend<S extends ColsMap> implements Backend {
      *  §4.1). Built fresh per call from state the backend already holds — no new instrumentation, no
      *  mutation. Only ever called by `@rindle/devtools` (imported in dev). */
     __inspect(): OptimisticInspect;
+    /** Test-only per-domain ledger snapshot (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1/§8.5).
+     *  Kept separate from {@link __inspect} so the devtools `OptimisticInspect` mirror stays byte-for-
+     *  byte identical (daemon-scalar-only). Exposes the per-domain `nextMid`/`watermark` maps plus each
+     *  pending entry's confirming domain — the axes the §8.5 ledger-isolation assertion checks. */
+    __inspectDomains(): {
+        nextMid: Record<string, number>;
+        watermark: Record<string, number>;
+        /** Per connected CHANNEL (§5.1): its release watermark + buffered-frame depth — the axis the
+         *  gate-isolation assertions read (one source's laggy cvMin must never move the other's) —
+         *  plus the §301 upstream-absorption advert last recorded from its progress frames (a ROOM
+         *  gate with a new shell; absent otherwise). */
+        gates: Record<string, {
+            appliedCv: number;
+            bufferedFrames: number;
+            upstreamCv?: number;
+            upstreamBoot?: string;
+        }>;
+        /** The §3 router's counters (H-iii) — Q6's measurement hook: how often derivation succeeded
+         *  (per derived room) and why it fell to the daemon (per reason). See {@link RoutingInspect}
+         *  for the counting discipline (per-candidate failures; pins bump nothing). */
+        routing: RoutingInspect;
+        /** The §4 lifecycle plane's folded state (Slice I-iii introspection): the per-doc §4.2 fence
+         *  value (`roomWatermarks`, I-v's ghost-drop input), the per-scope §4.1 occupancy map
+         *  (`scopeSessions`: scope → client_id → expires_at, I-iv's doorbell input), and the live
+         *  I-v ghosts (demoted room sources still awaiting their fence). */
+        lifecycle: {
+            roomWatermarks: Record<string, number>;
+            scopeSessions: Record<string, Record<string, number>>;
+            ghosts: Record<string, {
+                doc: string;
+                finalFlushSeq: number;
+                tables: string[];
+            }>;
+        };
+        /** The live §301 pin registry (`301-ECHO-FENCE-DESIGN.md` §2.5 — the devtools/Q6 surface):
+         *  every parked hold-back's fence inputs plus its tripwire state, keyed
+         *  `${table}\0${sourceKey}\0${pkKey}`. Pruned lazily, so an entry here may briefly outlive
+         *  its engine pin (never the reverse). */
+        pins: Record<string, {
+            table: string;
+            sourceKey: string;
+            domain: string;
+            mid: number;
+            daemonBoot?: string;
+            daemonCv?: number;
+            tripwired: boolean;
+        }>;
+        /** The §301 direction-A fence map: per room domain, the highest DAEMON-CARRIED ledger lmid. */
+        daemonCarriedLmid: Record<string, number>;
+        pending: {
+            mid: number | null;
+            seq: number | null;
+            name: string;
+            domain: string;
+            touchedSources: string[];
+            writeSources: Record<string, string>;
+        }[];
+    };
     /** Recompute the pending axis for every query and fire `onPending` on transitions only. Called
      *  from the two points that move the pending set: invoke/invokeFolded (add) and the confirm-drop
      *  (remove) — exactly where `:359`/`:468` used to flip ResultType (§7.3). */
     private refreshPending;
-    private onNormalized;
+    private onFrame;
     private emitServerDelta;
     private localQidsForSource;
-    private onProgress;
-    /** Fold the lmid system query's released ops (lmid-as-data): the one row's
-     *  `last_mutation_id` cell is this client's confirmed high-water mid. */
+    /** One gate's release (§5.1 release gate): compute the coherent delta from THIS gate's cv-buffer,
+     *  then apply it against the gate's source/domain. Split into {@link computeRelease} (buffer →
+     *  delta, lmid → watermark) and {@link applyRelease} (per-source confirm-drop + reconcile) —
+     *  N independent gates all feed the ONE apply half; {@link __testRelease} drives it directly. */
+    private onGateProgress;
+    /** Compute one coherent release from ONE gate's cv-buffer (§5.1) — gate-scoped: its buffer, its
+     *  cvMin timeline. Take every buffered frame at `cv ≤ cvMin`, in (cv, arrival) order, and fold
+     *  it: the lmid system-query frame advances `watermark[gate.key]` (via {@link foldLmidOps} — the
+     *  daemon stream folds "daemon", a room stream folds its own domain); data frames fold through
+     *  this SOURCE's cross-query refcount into ONE net base delta — the §1.3 `D`. Returns that delta
+     *  plus the set of local views this release JUST hydrated (so their reconcile batch phases as a
+     *  `snapshot`). Mutates the gate's buffer/`appliedCv`, hydration, and the gate's domain
+     *  watermark; the pending set and the reconcile are {@link applyRelease}'s job. */
+    private computeRelease;
+    /** Apply one released delta against `sourceKey`'s domain (§7.2 per-domain confirm-drop + the §1.3
+     *  reconcile cycle). `watermarkUpdate`, when given, advances `watermark[sourceKey]` first — the
+     *  hook a per-source lmid confirm rides on (the daemon path folds its watermark in
+     *  {@link computeRelease} and passes `undefined`). Then: drop every pending entry its OWN domain's
+     *  watermark now covers (a room confirm can never retire a daemon entry, and vice-versa — the §7.1
+     *  ledger-collision fix), and run the reconcile cycle against `sourceKey` when the base delta or the
+     *  pending set changed. `newlyHydrated` stamps the initial-hydration batch as a catch-up. */
+    private applyRelease;
+    /** Test-only per-source release seam (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.2/§8.5): drive
+     *  {@link applyRelease} for `sourceKey` directly — an explicit `watermarkUpdate` (a simulated lmid
+     *  confirm for that domain) and `deltas` (a coherent base delta), with no real gate. Lets a harness
+     *  exercise a room-domain confirm before the real second lmid stream / per-source gate is wired
+     *  (E-iii-b/c). The `__`-prefix marks it a test hook, alongside {@link __inspect}. */
+    __testRelease(sourceKey: string, deltas: Mutation[], watermarkUpdate?: number): void;
+    /** Register (or overwrite — a later cross-slice confirm re-pinning the same slice-pk matches
+     *  the engine's `held_back.insert`) one {@link EchoFencePin}, in the same breath as the
+     *  engine park (§2.1). `p` is the confirmed entry whose write staged onto `sourceKey`; its
+     *  `mid` is non-null by the caller's confirm filter. */
+    private registerPin;
+    /** The §2.3 drop pass, run at the tail of every applied release: prune registry entries whose
+     *  engine pin is already gone (the rewind's state-match fallback or a whole-source removal beat
+     *  the fence — benign), drop every pin whose fence cleared (one engine drop each, delivered on
+     *  the ordinary event stream, bracketed as ONE notification commit), and tripwire the rest. */
+    private dropEchoFencePins;
+    /** Has `pin`'s delivery fence provably closed its confirm→echo window? (§2.3/§2.4.) */
+    private pinFenceCleared;
+    /** The §2.5 stuck-pin tripwire, in the scopesHash spirit: log ONCE per pin when its slice's
+     *  baseline row has CHANGED VALUE since park while the pin still holds — the suspicious state
+     *  that precedes every forever-pin (a fence-less pairing, a fence bug). Never drops anything. */
+    private maybeTripwirePin;
+    /** Record one observed daemon boot id (§2.4): first observation of an id assigns the next
+     *  ordinal (the client's own total order over opaque boot ids); every call refreshes the
+     *  current-boot stamp for direction-B parks. */
+    private observeDaemonBoot;
+    /** Promote `table` to a MERGED multi-source engine with room `sourceKey`'s per-row writable
+     *  scope (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §5.2) — THE one promotion seam. The engine
+     *  attach and the {@link promotedTables} record move in the same breath: the §7.3 hold-back
+     *  trigger in {@link applyRelease} parks ONLY on promoted tables, so a promotion that bypassed
+     *  the record would silently disable the echo hold-back for that table (and a record without the
+     *  engine attach would park onto a slice that doesn't exist). Recorded AFTER the engine accepts —
+     *  a rejected descriptor/table must not leave a phantom promotion. Slice G-v's client drives this
+     *  from the lease's `realtime.tables` (`RoomTableSpec` → {@link WritableDescriptor}); idempotence
+     *  per `(sourceKey, table)` is the CALLER's job (the engine refuses a duplicate room).
+     *
+     *  `spec` (H-iii) is the per-table ROUTING spec riding the same lease table block — recorded
+     *  into {@link roomRouting} (THE routing table the §3 router reads) in the same breath, with
+     *  `writable` derived from the descriptor's kind (`none` = a context table the room may not
+     *  write). Omitted (the E-iii-b harness alias below) ⇒ an empty spec: no join keys to guard, no
+     *  `footprintWhere` (that room's reads then fail closed to the daemon unless self/room-served). */
+    promoteRoomTable(table: string, sourceKey: string, writable: WritableDescriptor, spec?: RoomTableRoutingSpec): void;
+    /** The recorded routing specs for `sourceKey`'s promoted tables (table → its
+     *  {@link RoomTableRouting}) — read-only: the client's `__realtimeInspect`/idempotence
+     *  bookkeeping reads THIS record instead of keeping its own shadow copy (one source of truth).
+     *  Empty map when the room has promoted nothing. */
+    roomTablesFor(sourceKey: string): ReadonlyMap<string, RoomTableRouting>;
+    /** Test-named alias of {@link promoteRoomTable} (E-iii-b scaffolding — the multi-domain oracle
+     *  and per-source-gate suites drive it). Pure delegation: ONE body, one `promotedTables` record. */
+    __addRoomSource(table: string, roomKey: string, writable: WritableDescriptor, spec?: RoomTableRoutingSpec): void;
+    /** Fold `domain`'s lmid system query's released ops (lmid-as-data): the one row's
+     *  `last_mutation_id` cell is this client's confirmed high-water mid in that domain — it advances
+     *  `watermark[domain]` and, on a fresh session ahead of our issued mids, `nextMid[domain]`. The
+     *  daemon stream folds `"daemon"`; a room stream folds its own `"room:doc:X"`; the daemon-carried
+     *  §7.1 ledger rows fold through the same {@link foldConfirm} core (Slice I-iii). */
     private foldLmidOps;
+    /** THE one confirm fold (§7.1/§7.2): advance `watermark[domain]` to `lmid` (monotone max) and,
+     *  on a fresh session ahead of our issued mids, adopt `nextMid[domain]`. Shared verbatim by the
+     *  per-channel lmid system query ({@link foldLmidOps}) and the daemon-carried room-ledger rows
+     *  ({@link foldSystemFrames} — one core so the two paths cannot drift). */
+    private foldConfirm;
+    /** Fold one release's SYSTEM frames in a FIXED category order — the order is STRUCTURAL (one
+     *  function, categories in sequence), because it is the client half of THE NAMED INVARIANT
+     *  (§3.3's shipped note; documented above {@link handleMutationOutcome}): **never retire a
+     *  room-domain entry off a daemon-carried lmid without outcome resolution.**
+     *
+     *    1. **outcome rows** (`_rindle_room_mutation_outcomes`) — each row for OUR clientID is
+     *       synthesized into a {@link MutationOutcomeFrame} and routed through
+     *       {@link handleMutationOutcome}, the SAME H-v state machine the room socket's frames use
+     *       (one verdict path: frames and rows cannot drift). A deopt flips its pending entry to
+     *       the daemon IN PLACE (keep-seq, deal-and-send-now); a rejection surfaces + stays for the
+     *       ordinary burnt-mid retire; a duplicate (frame already seen, or the row re-delivered) is
+     *       absorbed by the processed set — which doubles as the resolved-verdict memory across
+     *       releases (per-domain FIFO, {@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}, mirroring the
+     *       shell's recorded-outcome cap).
+     *    2. **room-ledger rows** (`_rindle_room_client_mutations`) — the FIRST daemon-carried
+     *       room-lmid path: OUR row's `last_mutation_id` folds into `watermark[room:<doc>]` via
+     *       {@link foldConfirm}. Because step 1 ALREADY resolved every non-applied verdict this
+     *       release carries (and earlier releases' verdicts were resolved at their own release),
+     *       the confirm-drop that follows in {@link applyRelease} retires only entries whose
+     *       outcome is resolution-by-absence — which I-ii's co-commit atomicity defines as APPLIED
+     *       (a room flush co-commits the ledger row and every non-applied mid's outcome row in ONE
+     *       daemon transaction, so a covering lmid without a row IS the applied verdict).
+     *       Processing this category before step 1 is the violation, in two proven directions
+     *       (each run break→fail→revert against `test/system_streams.test.ts`): (a) the ledger's
+     *       fresh-session `nextMid` ADOPTION must not run before historical outcome rows are
+     *       judged — adopted-first, a previous session's retained deopt row passes the
+     *       "never-issued" guard and spuriously re-invokes a mutation that session already handled
+     *       (a double-apply); (b) the RETIRE must not precede resolution — it does not BECAUSE the
+     *       confirm-drop runs in {@link applyRelease}, strictly after this whole function. That
+     *       deferral is load-bearing: an "optimization" retiring inline with the watermark fold
+     *       retires a deopted entry as a silent success (the exact lost-write H-v exists to
+     *       prevent) and mis-attributes a rejected row's reason.
+     *    3. **watermark rows** (`_rindle_room_watermark`) — the §4.2 fence value, max-folded per
+     *       doc ({@link roomWatermarks}); I-v's ghost-drop consumer, no reaction here.
+     *    4. **scope-session rows** (`_rindle_scope_sessions`) — the §4.1 occupancy map
+     *       ({@link scopeSessions}); I-iv's doorbell consumer, no reaction here.
+     *
+     *  Ordinary data ops fold AFTER all of these (the caller's main loop) — outcome/ledger state
+     *  must be in place before {@link applyRelease}'s confirm-drop + reconcile consume the release.
+     *  Every row is filtered against the retain's {@link SystemStreamSpec} scope/doc AND (for the
+     *  client-keyed tables) our own `clientID` — defense in depth: the server predicate may have
+     *  been minted doc-only (no `clientId` at lease time), so other clients' rows are expected and
+     *  must be ignored, and a row for a doc this retain was not minted for is never folded.
+     *
+     *  Returns the scopes category 4 touched (snapshot or ops) — the I-iv doorbell events' input;
+     *  `null` when none (every non-lifecycle release). The events themselves fire from
+     *  `onGateProgress` AFTER the release applies, never from inside the fold. */
+    private foldSystemFrames;
+    /** The I-iv occupancy count — THE one rule (§4.1/D7): unexpired (`expires_at >` the fold
+     *  clock's now) sessions under `scope` from OTHER clientIDs. Shared by the doorbell events
+     *  ({@link onGateProgress}) and the client's registration-time check (a doorbell that folded
+     *  BEFORE a candidate registered must still be able to trigger it) so the two can never
+     *  disagree. Own-clientID rows never count — a solo client cannot ring its own bell — and
+     *  expiry is judged on the injectable {@link FoldClock} (deterministic in a virtual-clock
+     *  harness, the folded-oracle discipline). */
+    otherScopeSessions(scope: string): number;
+    /** Register the I-iv doorbell event sink — see {@link ScopeSessionsEvent}. One handler (a later
+     *  registration replaces it, the {@link onLocalWrite} convention); client.ts is the consumer. */
+    onScopeSessions(handler: (event: ScopeSessionsEvent) => void): void;
     /** One §1.3 reconcile cycle: rewind the optimistic layer and fold the coherent SERVER
      *  delta into BOTH head AND the `sync` baseline (`serverBatchBegin`), re-invoke every
      *  still-pending mutator to re-stage the optimistic layer (the rewind un-applied it), then
@@ -322,18 +1157,20 @@ export declare class OptimisticBackend<S extends ColsMap> implements Backend {
      *  boundary — `onProgress` releases and `unregisterQuery`'s GC both go through here so head
      *  and sync never diverge (the §1.2 invariant; CRIT#2). */
     private runReconcileCycle;
-    /** The daemon restarted (a new boot id): it lost all materialization + `cv` state and its `cv`
-     *  sequence reset, so previously-released `cv`s no longer bound the new stream. The source has
-     *  already re-subscribed every query (reconnect → resync); drop the buffer and the `cv`
-     *  watermark so the fresh, low-`cv` snapshots are RELEASED instead of dropped as stale
-     *  (`onNormalized`/`onProgress` gate on `appliedCv`). Pending optimistic mutations stay put —
-     *  they re-apply on the next reconcile, and the lmid system query's fresh snapshot restores the
-     *  confirmation watermark. */
-    private resetForRestart;
-    /** The §8.5 escape: the buffer outgrew its cap (a pinned `cvMin` under churn). Drop
-     *  everything buffered and re-register every query on the source — the fresh
-     *  snapshots arrive as ordinary frames and the next release re-hydrates via the
-     *  footprint diff (the §5.3 path); still-pending optimism re-applies in that cycle. */
+    /** ONE channel's authority restarted (a new boot id): it lost all materialization + `cv` state
+     *  and its `cv` sequence reset, so previously-released `cv`s no longer bound the new stream. The
+     *  source has already re-subscribed every query (reconnect → resync); drop THIS gate's buffer
+     *  and `cv` watermark so the fresh, low-`cv` snapshots are RELEASED instead of dropped as stale
+     *  (`onFrame`/`computeRelease` gate on `appliedCv`). The OTHER gates are untouched — an
+     *  authority restart is per-channel (§5.1). Pending optimistic mutations stay put — they
+     *  re-apply on the next reconcile, and the channel's lmid system query's fresh snapshot restores
+     *  its domain's confirmation watermark. */
+    private resetGate;
+    /** The §8.5 escape: ONE gate's buffer outgrew its cap (a pinned `cvMin` under churn on that
+     *  channel). Drop everything it buffered and re-register every query on that source — the fresh
+     *  snapshots arrive as ordinary frames and the next release re-hydrates via the footprint diff
+     *  (the §5.3 path); still-pending optimism re-applies in that cycle. The other gates' buffers
+     *  and subscriptions are untouched. */
     private overflow;
     private setResultType;
     /** Recompute a query's server-channel state from hydration alone (§7): a pending mutation no
@@ -343,8 +1180,26 @@ export declare class OptimisticBackend<S extends ColsMap> implements Backend {
      *  lift those views out of `unknown` (loading). Idempotent — a re-hydrate snapshot re-marks
      *  harmlessly; a source qid with no sub (the lmid system query) is a no-op. */
     private markSubHydrated;
+    /** `channel` (G-iii registration-time routing): the gate the sub registers on — the qid's
+     *  ownership is fixed HERE, at retain time (no lazy claim; `onFrame` only asserts it). Default
+     *  `"daemon"`, so every channel-less caller is byte-identical to before. */
     private retainRemote;
     private releaseRemote;
     private addServerDependencyTables;
 }
+/** Whether `cond` is decidable from the KEY ALONE: every column it references — collected from
+ *  BOTH operand positions (under-counting could over-claim decidability; over-counting only fails
+ *  closed — the H-iv-a discipline) — is a pk column. A `correlatedSubquery` is never key-local. */
+export declare function keyDecidable(cond: Condition, pkCols: ReadonlySet<string>): boolean;
+/** Evaluate a key-decidable `footprintWhere` on a read's pk cells — H-iii's ONE client-side
+ *  non-engine evaluator, DELIBERATELY MINIMAL (the TS evaluation caveat on the router block
+ *  comment): `simple` `=`/`!=` between a pk COLUMN and a same-primitive-type NON-NULL literal,
+ *  composed under and/or. The empty AND — the compiler's vacuous-true emission for an exact
+ *  unconstrained footprint root — evaluates `true` (load-bearing: whole-table footprints keep
+ *  provable reads); the empty OR is vacuous-false. Returns `undefined` = NOT EVALUABLE for
+ *  anything else (other ops, null on either side, cross-type comparisons, column-vs-column,
+ *  literal-vs-literal, non-primitive cells, correlated subqueries) — the caller fails to the
+ *  daemon. A non-evaluable node anywhere poisons the whole tree (no short-circuit past it):
+ *  partial evaluation could otherwise claim a verdict the engine's semantics might contradict. */
+export declare function evalFootprintOnPk(cond: Condition, pkCells: ReadonlyMap<string, WireValue>): boolean | undefined;
 //# sourceMappingURL=backend.d.ts.map