@rindle/optimistic 0.4.3 → 0.5.0

package/dist/backend.js

@@ -37,10 +37,11 @@
 //
 // `Store`/`ArrayView` are untouched: this implements `Backend`, so
 // `new Store(schema, new OptimisticBackend(...))` reuses the whole machinery.
-import { CLIENT_MUTATIONS_SCHEMA, driveMutationSync, insertCell, insertPlan, isGeneratorMutator, isoTx, LMID_QUERY_NAME, localTableNames, normalizedTableSchemas, tableSpec, toCell, } from "@rindle/client";
+import { CLIENT_MUTATIONS_SCHEMA, driveMutationSync, insertCell, insertPlan, isGeneratorMutator, isoTx, LMID_QUERY_NAME, localTableNames, normalizedTableSchemas, rowsEqual, tableSpec, toCell, } from "@rindle/client";
 import { aggTableSchemas, NormalizedSync, rewriteAggregates } from "@rindle/normalized";
 import { WasmBackend } from "@rindle/wasm";
 import { AggOverlay, collectAggDefs } from "./agg-overlay.js";
+import { decodeOutcomeRow, LIFECYCLE_TABLE_SCHEMAS, ROOM_CLIENT_MUTATIONS_TABLE, ROOM_MUTATION_OUTCOMES_TABLE, ROOM_WATERMARK_TABLE, roomDomainKey, SCOPE_SESSIONS_TABLE, } from "./system-streams.js";
 /** The reserved source-qid of the backend's own lmid system query. User/local query ids
  *  are assigned by the `Store` starting at 1, so 0 never collides. */
 const LMID_QID = 0;
@@ -56,6 +57,13 @@ const REAL_CLOCK = {
     clearTimeout: (h) => clearTimeout(h),
     now: () => Date.now(),
 };
+/** The (shared, frozen-by-convention) empty map {@link OptimisticBackend.roomTablesFor} answers
+ *  for a room with no promoted tables. */
+const EMPTY_ROUTING = new Map();
+/** Per-domain retention cap for the processed-outcome set (H-v) — mirrors the shell's
+ *  `MAX_RECORDED_OUTCOMES_PER_CLIENT`: the sender caps what it can re-answer at 512 per client,
+ *  so remembering more than 512 processed mids per domain buys nothing. */
+const MAX_PROCESSED_OUTCOMES_PER_DOMAIN = 512;
 export class OptimisticBackend {
     local;
     sync;
@@ -78,6 +86,9 @@ export class OptimisticBackend {
      *  its width check. */
     colCounts;
     colIndex;
+    /** Per-table pk column indices — held so `connectSource` can build a fresh per-source
+     *  `NormalizedSync` with the same layout the daemon's uses. */
+    pkCols;
     /** The client's OWN typed per-table schemas + the reserved lmid table — the fixed base
      *  of the expected-schema set (CRIT#4 validation). Synthetic agg tables are appended as
      *  queries arrive (`ensureSyntheticTables`). */
@@ -96,6 +107,18 @@ export class OptimisticBackend {
      *  pending delta `displayed = server_base ⊕ local_pending_delta` is applied from. */
     overlay = new AggOverlay();
     handler = () => { };
+    // The local qids whose reconcile-cycle batch delivery this release is their FIRST hydration (empty
+    // → full): their batch is the initial result set arriving as a delta, so it is stamped `catchUp`
+    // and the Store maps it to the `snapshot` change-phase (a narrator ignores it by default). Non-null
+    // only for the duration of the reconcile cycle in `onProgress`; a re-hydrate after a drop is a real
+    // footprint diff (genuine change) and is NOT remapped. See {@link ChangeEvent} `catchUp`.
+    catchUpQids = null;
+    /** Newly-hydrated qids whose reconcile ACTUALLY emitted a (catch-up-stamped) batch — recorded by the
+     *  local-event forwarder alongside {@link catchUpQids}. After the reconcile, any newly-hydrated qid
+     *  NOT in here folded nothing (0 rows, or its result already present via a sibling → 0 net muts, or
+     *  the reconcile was skipped), so `onProgress` sends it an explicit empty catch-up — else its SSR
+     *  seed would never retire (the view freezes). Non-null only for the reconcile's duration. */
+    catchUpEmitted = null;
     /** The Store's commit-boundary handler ({@link Backend.onCommitBoundary}), forwarded from the
      *  local engine's `dispatch` brackets so the Store folds every affected view before notifying any
      *  subscriber (cross-view-atomic notification). All this backend's data deltas originate from the
@@ -103,18 +126,140 @@ export class OptimisticBackend {
     boundaryHandler = () => { };
     devObservers = new Set();
     pendingMutations = [];
-    nextMid = 1;
+    /** The next mid to deal, PER DOMAIN (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1): a client
+     *  writing through room + daemon concurrently must not alias one lmid counter. Seeded with the
+     *  `"daemon"` stream at 1; a domain absent from the map starts at 1. In the single-domain
+     *  configuration only `"daemon"` is ever touched, so the sequence is byte-for-byte as before. */
+    nextMid = new Map([["daemon", 1]]);
+    /** The client-global deal counter behind {@link PendingMutation.seq}: one sequence across ALL
+     *  domains, bumped whenever any domain's mid is dealt. The replay order (mids are per-domain and
+     *  incomparable across domains — see the `seq` field doc). */
+    dealSeq = 0;
+    /** The explicit confirming-stream override (§7.1/§3) — see
+     *  {@link OptimisticBackendOptions.domainPolicy}. `undefined` from it ⇒ H-iii derivation. */
+    domainPolicy;
+    /** The final-rejection reason surface ({@link OptimisticBackendOptions.onRejected}). */
+    rejectedHandler;
+    /** Processed `(domain, mid)` outcome frames (H-v) — the deopt handshake's idempotence guard: a
+     *  duplicate frame (the original plus a reconnect re-send's re-answer, or two re-answers across
+     *  two reconnects) must not double-invoke. Needed precisely because a deopt frame can arrive for
+     *  an ALREADY-RETIRED mid (the replay gotcha) — "no matching entry" alone cannot distinguish
+     *  "handle it fresh" from "already handled". Per-domain FIFO, capped like the shell's
+     *  recorded-outcome map ({@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}); past the cap a duplicate of
+     *  an evicted mid would be re-processed — the same bounded-window trade the shell makes, and it
+     *  takes 512 interleaving non-applied outcomes on one domain to open it. */
+    outcomesProcessed = new Map();
+    /** THE routing table (H-iii §3): per connected room `sourceKey` → per promoted table → its
+     *  client-held {@link RoomTableRouting}. Written ONLY by {@link promoteRoomTable} (same breath
+     *  as the engine attach + {@link promotedTables}); read by {@link deriveDomain} and — via
+     *  {@link roomTablesFor} — the client's `__realtimeInspect` bookkeeping. */
+    roomRouting = new Map();
+    /** Q6 counters ({@link RoutingInspect}): successful derivations per room. */
+    routingDerived = new Map();
+    /** Q6 counters ({@link RoutingInspect}): derivation failures per {@link RoutingFailureReason}. */
+    routingReasons = new Map();
     /** The live fold entries, by fold key `${name}\0${identityJSON}` — at most one per key
      *  (FOLDED-MUTATIONS-DESIGN §8). Insertion order is creation order (the drain/flush tiebreak). */
     folds = new Map();
     /** The fold debounce clock (real timers by default; the oracle injects a virtual one). */
     clock;
-    /** The high-water confirmed mutation id, folded from the lmid system query's
-     *  RELEASED ops (lmid-as-data) — never from a frame. */
-    confirmedLmid = 0;
-    buffer = [];
-    nextSeq = 0;
-    appliedCv = 0;
+    /** The high-water confirmed mutation id, PER DOMAIN (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md
+     *  §7.2 per-domain confirm-drop): an entry with `mid <= watermark[entry.domain]` has been
+     *  confirmed. The `"daemon"` domain is folded from the lmid system query's RELEASED ops
+     *  (lmid-as-data) — never from a frame; a room domain will fold from its own lmid stream (later
+     *  slice). Seeded with `"daemon"` at 0; the daemon scalar `confirmedLmid` (devtools) is
+     *  `watermark.get("daemon")`. */
+    watermark = new Map([["daemon", 0]]);
+    /** The per-source coherence gates (§5.1), by source key. Seeded with the daemon gate at
+     *  construction; a room channel attaches later (`connectSource`). Single-domain: one entry,
+     *  and every gate-generalized path degenerates to the old single-buffer code. NOT the same
+     *  space as {@link watermark}/{@link nextMid}: a DOMAIN can confirm with no gate connected
+     *  (the `__testRelease` seam); a gate's `key` names the domain its lmid stream folds into. */
+    gates = new Map();
+    /** The daemon's gate — the always-present channel (constructor-attached). The devtools
+     *  scalars (`__inspect`) read it directly; its `sync` IS {@link sync} (the agg overlay and
+     *  synthetic tables are daemon-tracked by design). */
+    daemonGate;
+    /** Tables promoted to a MERGED multi-source engine (a room source attached). Written by the one
+     *  promotion seam ({@link promoteRoomTable}; the test-named {@link __addRoomSource} and Slice
+     *  G-v's lease-driven promotion from `RoomTableSpec[]` both flow through it). Read by the §7.3
+     *  hold-back trigger in
+     *  {@link applyRelease}: parking on a never-promoted (Collapsed) table is SKIPPED — inert anyway
+     *  today (`rewind_collapsed` never consults `held_back`), and a live hazard if the table later
+     *  promotes (a stale Collapsed-era entry turns overlay-first-visible and pins forever). Slice H's
+     *  prove-or-slow-path routing keeps the real scenario — a room-confirmed mutation writing a
+     *  Collapsed table — impossible; this gate covers the window until then. */
+    promotedTables = new Set();
+    /** The §301 pin registry ({@link EchoFencePin}): every parked §7.3 hold-back's delivery-fence
+     *  inputs, keyed `${table}\0${sourceKey}\0${pkKey}`. Written in the same breath as the
+     *  `holdBack`/`holdBackAbsent` park; read by {@link dropEchoFencePins} at the tail of every
+     *  release. Empty on every single-domain client — the drop pass is then a structural no-op. */
+    pins = new Map();
+    /** The §301 direction-A fence input: per room domain, the highest lmid the DAEMON-CARRIED
+     *  ledger rows have folded ({@link foldSystemFrames} step 2 — and ONLY that path: the room
+     *  socket's own lmid stream confirms long before the flush reaches the daemon, so it folds
+     *  into the shared {@link watermark} but never here, 301 §1.1). When this covers a pin's mid,
+     *  the same coherent release (or an earlier one) folded the flush data that carried it into
+     *  the daemon baseline — the fence. */
+    daemonCarriedLmid = new Map();
+    /** The §301 §2.4 boot rule's inputs: the daemon boot ids this client has OBSERVED, in order
+     *  (id → ordinal), plus the current one. Boot ids are opaque — ordering is the client's own
+     *  observation ({@link OptimisticSource.onBootId} on the daemon gate). Direction-B pins stamp
+     *  the current boot; a room advertising a LATER-observed boot proves absorption (its
+     *  re-snapshot came from a daemon state that durably includes the confirmed write). */
+    daemonBootOrdinals = new Map();
+    daemonBootId;
+    /** The per-read provenance probe `invoke` hands `trackingTx` when recording is armed (H-ii,
+     *  §3.2 #3): the engine's `provenanceOf` — the VISIBLE overlay-first winner for the row's pk,
+     *  read from LIVE pre-commit state (an open txn's staged writes are not consulted; H-i). Gated
+     *  on PER-TABLE {@link promotedTables} membership — the cheapest existing signal, and the
+     *  correct one: provenance is an ENGINE-merge question, not a channel question ({@link gates}
+     *  can hold a connected-but-unpromoted room feed, and the oracle harness promotes with no gate),
+     *  and a never-promoted (Collapsed) table is daemon-owned by construction. So a pure
+     *  single-domain app pays ZERO wasm calls per recorded read; the recorded `source` is then
+     *  `undefined`, which is also correct — everything is daemon-owned (see {@link ReadRecord}). */
+    readProvenance = (table, row) => this.promotedTables.has(table) ? this.local.provenanceOf(table, row) : undefined;
+    // --- the §4 lifecycle SYSTEM-STREAM plane (Slice I-iii) --------------------------------
+    /** System retains by source qid ({@link retainSystemQuery}): a subscription with NO store view
+     *  and NO user-visible table — its frames buffer on its gate exactly like {@link LMID_QID}'s and
+     *  fold at RELEASE time ({@link foldSystemFrames}), never entering the sync layer or the local
+     *  engine. The spec names which system table the qid serves and the scope/doc it was minted for
+     *  (the fold's row filter). Empty on every non-lifecycle client — every partition below is then
+     *  a structural no-op and the release path is byte-identical to before. */
+    systemQids = new Map();
+    /** The §4.2 fence state: room doc → highest `flush_seq` delivered through the daemon plane
+     *  (monotone max-fold; a remove never regresses it). Slice I-v's ghost-drop consumer — I-iii
+     *  only maintains + exposes it (`__inspectDomains().lifecycle`). */
+    roomWatermarks = new Map();
+    /** The §4.1 occupancy state: scope → (client_id → expires_at) from the doorbell stream. Slice
+     *  I-iv's doorbell consumer (the 1→2 re-lease reaction) — I-iii only maintains + exposes it.
+     *  A snapshot REPLACES the scope's map (authoritative re-hydrate); a batch folds add/edit/remove
+     *  incrementally (the age-out sweep's deletes arrive as removes). */
+    scopeSessions = new Map();
+    /** The I-iv doorbell event sink ({@link onScopeSessions}) — fired once per scope a release's
+     *  scope-session fold touched, AFTER the whole release applied. Default no-op: a client that
+     *  never registers (no lifecycle plane) pays nothing. */
+    scopeSessionsHandler = () => { };
+    /** Deferred old-channel row GC for in-flight upgrade retargets ({@link retargetRemoteQuery}):
+     *  sub sourceQid → the channel it left. The rows the OLD gate's sync holds for the qid stay
+     *  visible (merge: daemon tier) until the sub's first snapshot RELEASES on its new room channel
+     *  ({@link flushRetargetGc}) — dropping them at retarget time would emit net removes ahead of
+     *  the room's re-adds, the flicker the two-phase cutover exists to avoid. Doubles as the
+     *  wrong-channel GRACE window in {@link onFrame}: a frame already in flight from the old
+     *  channel when the sub moved is stale, not a wiring bug. Empty on every non-upgrade client —
+     *  every consultation below is then a structural no-op. */
+    pendingRetargetGc = new Map();
+    /** The §4.2 GHOSTS (Slice I-v): demoted room sources awaiting their watermark fence, by
+     *  sourceKey. Written only by {@link demoteRoomSource}; evaluated after every release
+     *  ({@link evaluateGhosts}) and dropped by {@link dropGhost} once the fence clears with no
+     *  sent room-domain pending left. Empty on every non-downgrade client — the per-release
+     *  evaluation is then a structural no-op. */
+    ghosts = new Map();
+    /** The I-v stuck-downgrade surface ({@link onDowngradeStuck}) — fired AT MOST ONCE per ghost
+     *  when its fence is satisfied but sent room-domain mids remain unresolved (§7.5: they retire
+     *  only through outcome resolution; the ghost holds rather than inventing a timeout-retire).
+     *  Default no-op. */
+    downgradeStuckHandler = () => { };
     asts = new Map();
     /** Per query: the base tables its result can draw from (from the AST tree). */
     queryTables = new Map();
@@ -132,15 +277,28 @@ export class OptimisticBackend {
      *  touches its tables. Cached so `onPending` fires only on transitions (invoke ↔ confirm). */
     pendingState = new Map();
     pendingHandler = () => { };
+    /** The local-persistence write-through tap (`207-LOCAL-TABLE-PERSISTENCE-DESIGN.md` §5.1):
+     *  {@link writeLocal} invokes it post-commit; {@link applyLocalReplica} deliberately does not. */
+    localWriteObserver = null;
     constructor(schema, source, registry, opts) {
         this.local = new WasmBackend(schema);
-        this.local.onEvent((qid, ev) => this.handler(qid, ev));
+        this.local.onEvent((qid, ev) => {
+            // Stamp a newly-hydrating query's reconcile batch as a catch-up (initial-hydration) delivery,
+            // so the Store phases it as a `snapshot` rather than narrating the whole first result set. Record
+            // that we emitted a hydration batch for this qid, so `onProgress` knows which newly-hydrated qids
+            // still need an explicit empty catch-up (they folded nothing — see {@link catchUpEmitted}).
+            const stamp = ev.type === "batch" && this.catchUpQids?.has(qid) === true;
+            if (stamp)
+                this.catchUpEmitted?.add(qid);
+            this.handler(qid, stamp ? { ...ev, catchUp: true } : ev);
+        });
         // Forward the local engine's commit brackets up to the Store (cross-view-atomic notification):
         // every data delta this backend emits comes from `this.local`, so its commit boundaries are ours.
         this.local.onCommitBoundary((phase) => this.boundaryHandler(phase));
         this.colCounts = colCountsFromSchema(schema);
         this.colIndex = colIndexFromSchema(schema);
-        this.sync = new NormalizedSync(pkColsFromSchema(schema), this.colCounts);
+        this.pkCols = pkColsFromSchema(schema);
+        this.sync = new NormalizedSync(this.pkCols, this.colCounts);
         this.specs = tableSpecsFromSchema(schema);
         this.localTables = localTableNames(schema);
         this.source = source;
@@ -149,21 +307,81 @@ export class OptimisticBackend {
         this.user = opts.user ?? (() => "");
         this.bufferCap = opts.bufferCap ?? 1024;
         this.clock = opts.clock ?? REAL_CLOCK;
-        // Validate each server hello against our OWN typed schema → reject a schema skew
-        // (CRIT#4). The reserved lmid table is part of the expected set so the system
-        // query's hello passes. Synthetic agg tables join the set as queries register them.
-        this.clientTablesBase = [...normalizedTableSchemas(schema), CLIENT_MUTATIONS_SCHEMA];
-        this.source.expectClientSchema?.(this.clientTablesBase);
-        this.source.onNormalized((qid, ev) => this.onNormalized(qid, ev));
-        this.source.onProgress((frame) => this.onProgress(frame));
-        this.source.onRestart?.(() => this.resetForRestart());
-        // The lmid system query (lmid-as-data): our confirmations arrive on this stream,
-        // cv-tagged, released by the same cvMin as the data they belong to. The server
-        // derives the identity from the connection; args are advisory.
-        this.source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
+        // No policy configured ⇒ every route DERIVES (H-iii §3). With no room gate connected the
+        // derivation short-circuits to "daemon", so a single-domain app is byte-for-byte as before.
+        this.domainPolicy = opts.domainPolicy ?? (() => undefined);
+        this.rejectedHandler = opts.onRejected ?? (() => { });
+        // The reserved lmid table + (I-iii) the four lifecycle system tables join the expected set so
+        // a system subscription's hello passes CRIT#4 validation. Extra CLIENT-side entries are inert
+        // for every other server hello (validation only checks tables a server advertises), so a
+        // client that never receives a lifecycle block is byte-identical.
+        this.clientTablesBase = [...normalizedTableSchemas(schema), CLIENT_MUTATIONS_SCHEMA, ...LIFECYCLE_TABLE_SCHEMAS];
+        // The daemon is the always-present channel: its gate is attached at construction, and its
+        // per-source refcount space IS `this.sync` (the agg overlay reads it directly). A room
+        // channel attaches through the same seam later (§5.1; Slice G).
+        this.daemonGate = this.attachGate("daemon", source, this.sync);
+    }
+    /** Wire one authority channel into its own coherence gate (§5.1): every frame the channel
+     *  delivers buffers on THIS gate's cv timeline, its progress frames release THIS buffer, its
+     *  restart resets THIS gate alone, and its reserved lmid stream folds into `watermark[key]`.
+     *  Validates each server hello against our OWN typed schema → reject a schema skew (CRIT#4);
+     *  the reserved lmid table is part of the expected set so the system query's hello passes, and
+     *  synthetic agg tables join the set as queries register them. */
+    attachGate(key, source, sync) {
+        const gate = { key, source, sync, buffer: [], nextSeq: 0, appliedCv: 0 };
+        this.gates.set(key, gate);
+        source.expectClientSchema?.([...this.clientTablesBase, ...this.synthetic.values()]);
+        source.onNormalized((qid, ev) => this.onFrame(gate, qid, ev));
+        source.onProgress((frame) => this.onGateProgress(gate, frame));
+        source.onRestart?.(() => this.resetGate(gate));
+        // §301 §2.4: the DAEMON channel's observed boot-id stream seeds the client-local boot
+        // ordinals the direction-B fence's boot rule compares against (boot ids are opaque; order is
+        // the client's own observation). Only the daemon gate's boots matter — a room's advertised
+        // `upstreamBoot` names a DAEMON boot, and room-channel incarnations are handled by
+        // `resetGate`. Optional: an in-process source never reports one.
+        if (key === "daemon")
+            source.onBootId?.((bootId) => this.observeDaemonBoot(bootId));
+        // The deopt handshake's client half (H-v §3.3): the channel's `mutationOutcome` frames arrive
+        // as `(domain = gate.key, frame)`. OUT-OF-BAND — the source dispatches on arrival and this
+        // handler runs immediately, NEVER behind the gate's cv buffer: a deopt must migrate its entry
+        // BEFORE the buffered lmid release that would otherwise retire it as a success (and the §7.3
+        // hold-back trigger, keyed on `p.domain`, would park its staged writes the wrong way).
+        source.onMutationOutcome?.((frame) => this.handleMutationOutcome(gate.key, frame));
+        // §7.5 rule 3 (H-v): a re-established session re-sends this DOMAIN's unconfirmed pending
+        // envelopes with their ORIGINAL mids — the authority's own ledger dedups (an applied mid is
+        // silent; a non-applied one is re-answered from the recorded-outcome map into the handler
+        // above). This is the deopt crash-window closer: a frame lost with its socket is re-earned.
+        source.onResync?.(() => this.resendPending(gate.key));
+        // The lmid system query (lmid-as-data): confirmations arrive on this channel's stream,
+        // cv-tagged, released by the same cvMin as the data they belong to. The server derives
+        // the identity from the connection; args are advisory. Qid 0 is reserved PER CHANNEL —
+        // it never collides with Store-dealt qids and never enters the sync layer.
+        source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
+        return gate;
+    }
+    /** Attach a SECOND authority channel (§5.1) — the seam Slice G's room upgrade calls with the
+     *  ws-backed room feed. Rooms speak the daemon protocol verbatim (§2.4: the client cannot tell
+     *  a room from the daemon), so the argument is a full {@link OptimisticSource} — exactly what
+     *  `@rindle/remote` builds from `{roomUrl, leaseToken}`. The channel buffers/releases on its
+     *  own cv timeline (an independent §5.1 gate: coherent within, eventual across) and its
+     *  reserved lmid stream folds into `watermark[sourceKey]` — so `sourceKey` must equal the
+     *  `domainPolicy` name for the mutations this authority confirms. The converse is NOT required:
+     *  a domain may exist with no connected gate (`__testRelease` drives confirms gate-less); the
+     *  live production path stays daemon-only until G calls this. */
+    connectSource(sourceKey, source) {
+        if (this.gates.has(sourceKey)) {
+            throw new Error(`optimistic backend: source ${sourceKey} is already connected`);
+        }
+        this.attachGate(sourceKey, source, new NormalizedSync(this.pkCols, this.colCounts));
     }
     // --- the Backend seam ---------------------------------------------------------
-    registerQuery(qid, ast, remote) {
+    /** `channel` (G-iii registration-time routing) names the authority channel the remote sub
+     *  registers on — a `connectSource`d gate key; default `"daemon"` (every existing caller is
+     *  byte-identical). Slice G-v threads the lease's `realtime.sourceKey` here. Validated FIRST
+     *  (like the E3 check below): a bad channel must throw before any per-query state is recorded. */
+    registerQuery(qid, ast, remote, channel) {
+        if (remote)
+            this.requireGate(channel ?? "daemon");
         // queryTables is derived from the ORIGINAL ast — its `count(comments)` subquery names
         // `comment`, so an optimistic comment mutation flips this query to `unknown` (§6). The
         // local engine, by contrast, runs the REWRITTEN ast (reads the synthetic `__agg_*`).
@@ -196,7 +414,7 @@ export class OptimisticBackend {
         if (remote) {
             // A remote query is `unknown` until its first server snapshot lands (hydration); retainRemote
             // attaches it to the sub and sets the lifecycle against the sub's hydration state.
-            this.retainRemote(qid, remote);
+            this.retainRemote(qid, remote, qid, channel);
         }
         else {
             // No server stream (a purely local AST view — or the local half of a split retain whose
@@ -267,10 +485,19 @@ export class OptimisticBackend {
     }
     unregisterQuery(qid) {
         const remoteQid = this.releaseRemote(qid);
-        if (remoteQid !== undefined)
-            this.buffer = this.buffer.filter((f) => f.qid !== remoteQid);
-        // GC: rows this remote footprint SOLELY referenced fall to refcount 0 → net removes.
-        const gc = remoteQid === undefined ? [] : this.sync.dropQuery(remoteQid);
+        // GC: rows this remote footprint SOLELY referenced fall to refcount 0 → net removes. A qid
+        // lives on ONE channel, so at most one gate's dropQuery is non-empty (dropQuery of an
+        // unknown qid returns []) — but sweep every gate so this needs no ownership lookup.
+        const gcs = [];
+        if (remoteQid !== undefined) {
+            this.pendingRetargetGc.delete(remoteQid); // the sweep below covers a mid-retarget teardown
+            for (const gate of this.gates.values()) {
+                gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
+                const gc = gate.sync.dropQuery(remoteQid);
+                if (gc.length)
+                    gcs.push([gate.key, gc]);
+            }
+        }
         // Tear down the local pipeline+view first so the reconcile cycle below skips it.
         this.local.unregisterQuery(qid);
         // The GC removals must leave BOTH head AND the engine's `sync` baseline. A plain
@@ -278,9 +505,10 @@ export class OptimisticBackend {
         // optimistic REMOVE: the next release's rewind diffs head against sync+D and RESURRECTS
         // them, GC never frees anything, and a later query is served the stale/deleted row
         // forever (CRIT#2). Deliver them as a coherent SERVER delta instead — the same
-        // sync-moving boundary `onProgress` uses — so head and sync both drop the rows.
-        if (gc.length)
-            this.runReconcileCycle(gc);
+        // sync-moving boundary the release gate uses — so head and sync both drop the rows,
+        // against the SOURCE whose baseline held them.
+        for (const [key, gc] of gcs)
+            this.runReconcileCycle(key, gc);
         // The local pipeline is gone (no live conn) and the remote footprint's `__agg` rows were
         // GC'd above, so any synthetic table this was the last reader of can now be freed (§4).
         this.releaseSyntheticTables(qid);
@@ -291,10 +519,15 @@ export class OptimisticBackend {
         this.pendingState.delete(qid); // §7.2 cache, keyed by the local materialized qid (a monotonic
         // Store counter — re-materialize gets a fresh id, never this one again), so drop it on teardown.
     }
-    retainRemoteQuery(qid, remote, localQueryId, ast) {
+    /** `channel` as in {@link registerQuery} (G-iii): the gate the remote sub registers on; default
+     *  `"daemon"`. This is the split-retain seam G-v's resolve-then-register drives — resolve the
+     *  lease, learn `realtime.sourceKey`, `connectSource` it, then retain the query on that channel.
+     *  Validated FIRST so a bad channel throws before any synthetic-table refcount moves. */
+    retainRemoteQuery(qid, remote, localQueryId, ast, channel) {
+        this.requireGate(channel ?? "daemon");
         if (ast)
             this.ensureSyntheticTables(qid, ast);
-        this.retainRemote(qid, remote, localQueryId);
+        this.retainRemote(qid, remote, localQueryId, channel);
     }
     releaseRemoteQuery(qid) {
         const remoteQid = this.releaseRemote(qid);
@@ -305,10 +538,307 @@ export class OptimisticBackend {
         }
         if (remoteQid === undefined)
             return;
-        this.buffer = this.buffer.filter((f) => f.qid !== remoteQid);
-        const gc = this.sync.dropQuery(remoteQid);
-        if (gc.length)
-            this.runReconcileCycle(gc);
+        // A mid-retarget release: the every-gate sweep below IS the deferred old-channel GC
+        // (dropQuery hits the old gate's sync too), so retire the pending record — and its
+        // wrong-channel grace — with it.
+        this.pendingRetargetGc.delete(remoteQid);
+        // Per-gate sweep, like `unregisterQuery`: at most one gate owned this qid's frames/rows.
+        for (const gate of this.gates.values()) {
+            gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
+            const gc = gate.sync.dropQuery(remoteQid);
+            if (gc.length)
+                this.runReconcileCycle(gate.key, gc);
+        }
+    }
+    /** The Slice I-iv upgrade retarget (§4.1 "Retarget" / the doorbell reaction): move a LIVE
+     *  (name, args) sub — every retain of it and every local view it feeds, wholesale — from the
+     *  channel it lives on onto `sourceKey`'s (already-`connectSource`d, already-promoted) room
+     *  channel, WITHOUT the view ever dropping its rows. Returns the sub's wire `sourceQid` (the
+     *  identity the client's renewal loop re-subscribes with).
+     *
+     *  Why a dedicated primitive: the one-channel-per-(name,args) invariant ({@link retainRemote}'s
+     *  loud throw) is correct — a sub's frames must never split across two cv timelines — so the
+     *  upgrade cannot simply retain a second sub on the room and release the daemon one; and the
+     *  naive release-then-retain order GCs the daemon sync's rows synchronously (net removes emit,
+     *  the view flashes empty) a full ws round trip before the room's seq-0 snapshot refills it.
+     *  The cutover is therefore TWO-PHASE around the room's first release:
+     *
+     *   1. NOW (here): unsubscribe the old channel's wire sub, sweep its still-buffered frames for
+     *      this qid (their cv timeline continues without the sub — the hello-supersession
+     *      precedent), flip `sub.channel`, re-arm `sub.hydrated` (the room's own snapshot is the
+     *      cutover point), and register on the room source (its resolver presents the handed
+     *      roomToken). The old gate's SYNC rows are deliberately NOT dropped: they keep the view's
+     *      rows visible through the window (merge: the daemon-tier holder). Local views keep their
+     *      `hydrated` membership — the view stays `complete` on its authoritative daemon rows.
+     *   2. AT THE ROOM'S FIRST RELEASED SNAPSHOT ({@link flushRetargetGc}): the room source now
+     *      holds the footprint rows (folded via `serverBatchBegin(sourceKey)` — value-equal rows
+     *      re-hydrate as a net-zero diff, RT §3.4 per channel), so the deferred
+     *      `dropQuery`+reconcile on the OLD gate flips each pk's winner daemon→room value-equal:
+     *      net-zero again. No emission carries a disappearance at any point.
+     *
+     *  Idempotent per target channel: a sub already on `sourceKey` returns immediately (the
+     *  double-doorbell / re-entrancy guard — one retarget per (query, sourceKey), mirroring
+     *  {@link promoteRoomTable}'s caller-side per-(sourceKey, table) idempotence). Validates before
+     *  mutating: a throw here leaves the sub fully daemon-attached (the client's fail-open). */
+    retargetRemoteQuery(remote, sourceKey) {
+        const newGate = this.requireGate(sourceKey); // throw loudly BEFORE any sub state moves
+        const key = remoteKey(remote);
+        const sub = this.remoteSubs.get(key);
+        if (!sub) {
+            throw new Error(`optimistic backend: no live sub for query "${remote.name}" — nothing to retarget`);
+        }
+        if (sub.channel === sourceKey)
+            return sub.sourceQid; // already there — idempotent
+        const oldGate = this.gates.get(sub.channel) ?? this.daemonGate;
+        oldGate.source.unregisterQuery(sub.sourceQid);
+        oldGate.buffer = oldGate.buffer.filter((f) => f.qid !== sub.sourceQid);
+        this.pendingRetargetGc.set(sub.sourceQid, sub.channel);
+        sub.channel = sourceKey;
+        sub.hydrated = false;
+        newGate.source.registerQuery(sub.sourceQid, remote);
+        return sub.sourceQid;
+    }
+    /** Phase 2 of {@link retargetRemoteQuery}, run at the end of every gate release: once a
+     *  retargeted sub's first snapshot has RELEASED on its new channel (`sub.hydrated` re-armed at
+     *  retarget, re-set by {@link markSubHydrated} inside this very release), drop the qid's rows
+     *  from the OLD gate's sync and reconcile them out — after the room's rows are already applied,
+     *  so the winner flip is value-equal (net-zero; see the phase table above). A sub torn down
+     *  mid-window was already swept by `releaseRemoteQuery`/`unregisterQuery` (which delete the
+     *  record); a vanished record here is pruned defensively. */
+    flushRetargetGc(gate) {
+        if (this.pendingRetargetGc.size === 0)
+            return; // every non-upgrade release: structural no-op
+        for (const [sourceQid, oldGateKey] of this.pendingRetargetGc) {
+            const key = this.sourceToRemote.get(sourceQid);
+            const sub = key !== undefined ? this.remoteSubs.get(key) : undefined;
+            if (!sub) {
+                this.pendingRetargetGc.delete(sourceQid);
+                continue;
+            }
+            if (sub.channel !== gate.key || !sub.hydrated)
+                continue; // not this gate / not yet cut over
+            this.pendingRetargetGc.delete(sourceQid);
+            const oldGate = this.gates.get(oldGateKey);
+            if (!oldGate)
+                continue;
+            const gc = oldGate.sync.dropQuery(sourceQid);
+            if (gc.length)
+                this.runReconcileCycle(oldGateKey, gc);
+        }
+    }
+    // --- the §4.2 downgrade: demote → ghost → fence → drop (Slice I-v) ----------------------
+    /** The I-v downgrade orchestration primitive (§4.2/§7.4): retire room `sourceKey` behind the
+     *  watermark fence. The caller has ALREADY retargeted every live sub off the channel
+     *  ({@link retargetRemoteQuery} room→daemon — validated loudly below) and holds the fence from
+     *  the api-server's downgrade response (`finalFlushSeq` = the room's last COMMITTED flush seq;
+     *  `doc` keys the §4.2 watermark fold, {@link roomWatermarks}). Steps, in order:
+     *
+     *   1. **De-candidacy NOW**: the sourceKey's {@link roomRouting} entries are removed, so
+     *      {@link deriveDomain} stops proposing the room (zero candidates ⇒ `"daemon"`). Unsent
+     *      pending (`mid === null`) re-routes for free — a fold's flush re-derives from the live
+     *      candidate set (§7.5 rule 1). The engine's frozen scope still ANSWERS (`writableMatches`
+     *      / `provenanceOf` — freezing gates serving, not the scope definition); routing is
+     *      TS-gated here.
+     *   2. **Freeze** the WRITABLE promoted tables (`freezeSource`): the room slice becomes the
+     *      §4.2 ghost — wins-if-present in the merge (D4), so its rows (at-or-ahead of the daemon
+     *      until the flush echoes) stay visible while the slice accepts nothing. Context tables
+     *      (`writable: false`) are deliberately NOT frozen: the daemon is authoritative for them
+     *      LIVE (§5.2's context tier) and freezing would invert that, pinning a possibly-BEHIND
+     *      relayed copy over fresher daemon rows; unfrozen they keep exactly the live tiering.
+     *   3. **Disconnect** the channel ({@link disconnectSource}): handlers detached, gate + buffer
+     *      dropped. `nextMid`/`watermark`/processed-outcomes for the domain are KEPT FOREVER (§7.1:
+     *      an assigned mid pins its domain; a later re-upgrade of the same doc continues the
+     *      sequence — {@link connectSource} attaches a fresh gate and the lmid snapshot max-folds
+     *      into the surviving watermark). Disconnecting BEFORE the daemon sub's first release is
+     *      load-bearing: it makes {@link flushRetargetGc}'s deferred old-channel GC a no-op (gate
+     *      gone ⇒ record deleted, nothing dropped) — running that GC would rewind the room slice's
+     *      rows at daemon hydration, i.e. BEFORE the fence, surfacing a lagging follower's stale
+     *      images (the exact regression §4.2 exists to prevent). The ghost's rows leave only
+     *      through {@link dropGhost}'s `removeRoomSource`, value-equal under the fence.
+     *   4. **Ghost + first evaluation**: the record joins {@link ghosts} and is evaluated once
+     *      immediately — `finalFlushSeq === 0` (a never-flushed room) with no room-domain pending
+     *      drops on the spot, the single-daemon first-frame case.
+     *
+     *  In-flight discipline (§7.5): entries with `mid !== null` on `sourceKey` stay PINNED (rule
+     *  2 — never re-route a sent mutation); their resolution arrives via the daemon-carried
+     *  ledger+outcome folds (I-iii) and blocks the drop until then. Idempotent per sourceKey (a
+     *  second labeled query sharing the room demotes into the existing ghost). */
+    demoteRoomSource(sourceKey, doc, finalFlushSeq) {
+        if (sourceKey === "daemon") {
+            throw new Error("optimistic backend: the daemon source cannot be demoted");
+        }
+        if (this.ghosts.has(sourceKey))
+            return; // idempotent — one ghost per source
+        // Validate FIRST (nothing mutated yet): a live sub still on the channel would silently
+        // starve once the gate detaches — the caller must retarget every sub off the room first.
+        for (const sub of this.remoteSubs.values()) {
+            if (sub.channel === sourceKey) {
+                throw new Error(`optimistic backend: cannot demote ${JSON.stringify(sourceKey)} — query "${sub.remote.name}" is still retained on it (retarget it to the daemon first)`);
+            }
+        }
+        const routing = this.roomRouting.get(sourceKey);
+        const tables = routing ? [...routing.keys()] : [];
+        const writable = routing ? tables.filter((t) => routing.get(t).writable) : [];
+        this.roomRouting.delete(sourceKey); // (1) de-candidacy
+        for (const table of writable)
+            this.local.freezeSource(table, sourceKey); // (2) the ghost
+        this.disconnectSource(sourceKey); // (3) the channel
+        this.ghosts.set(sourceKey, { doc, finalFlushSeq, tables, stuckReported: false }); // (4)
+        this.evaluateGhosts();
+    }
+    /** Detach one connected room channel (Slice I-v step 3): the source's handlers are replaced
+     *  with no-ops (the {@link OptimisticSource} handler seam is single-registration, so this IS
+     *  the detach — a late frame from a dying socket can no longer touch any bookkeeping), its
+     *  reserved lmid sub is unregistered, and the gate — buffer, per-source sync, cv watermark —
+     *  is dropped from {@link gates}. The DOMAIN state deliberately survives forever:
+     *  `nextMid[sourceKey]`, `watermark[sourceKey]`, and the processed-outcome set are untouched
+     *  (§7.1 — an assigned mid pins its domain; a re-upgrade must continue, never restart, the mid
+     *  sequence; {@link connectSource} then attaches a fresh gate whose lmid snapshot max-folds
+     *  into the surviving watermark via {@link foldConfirm}). Closing the underlying transport is
+     *  the caller's job. Idempotent (a missing gate is a no-op). */
+    disconnectSource(sourceKey) {
+        if (sourceKey === "daemon") {
+            throw new Error("optimistic backend: the daemon source cannot be disconnected");
+        }
+        const gate = this.gates.get(sourceKey);
+        if (!gate)
+            return;
+        this.gates.delete(sourceKey);
+        gate.source.onNormalized(() => { });
+        gate.source.onProgress(() => { });
+        gate.source.onRestart?.(() => { });
+        gate.source.onMutationOutcome?.(() => { });
+        gate.source.onResync?.(() => { });
+        gate.source.unregisterQuery(LMID_QID);
+    }
+    /** Register the I-v stuck-downgrade sink — see {@link DowngradeStuckEvent}. One handler (a
+     *  later registration replaces it, the {@link onScopeSessions} convention); client.ts maps it
+     *  onto the loud anomaly surface. */
+    onDowngradeStuck(handler) {
+        this.downgradeStuckHandler = handler;
+    }
+    /** The I-v ghost-drop watcher (§4.2), run after every applied release ({@link applyRelease} —
+     *  the seam where {@link roomWatermarks} has just folded and the confirm-drop has just run) and
+     *  once at demote time. For each ghost: the fence must be satisfied
+     *  (`roomWatermarks[doc] ≥ finalFlushSeq`; 0 is trivially satisfied) AND no SENT room-domain
+     *  pending may remain (§7.5 — such entries resolve only through the daemon-carried
+     *  outcome/ledger folds; an entry that never reached the room is undecidable, so the ghost
+     *  HOLDS and the stuck event fires exactly once, naming the mids). Both satisfied ⇒
+     *  {@link dropGhost}. */
+    evaluateGhosts() {
+        if (this.ghosts.size === 0)
+            return; // every non-downgrade release: structural no-op
+        for (const [sourceKey, ghost] of [...this.ghosts]) {
+            if ((this.roomWatermarks.get(ghost.doc) ?? 0) < ghost.finalFlushSeq)
+                continue; // fence holds
+            const stuck = this.pendingMutations.filter((p) => p.domain === sourceKey && p.mid !== null);
+            if (stuck.length > 0) {
+                if (!ghost.stuckReported) {
+                    ghost.stuckReported = true;
+                    this.downgradeStuckHandler({ sourceKey, doc: ghost.doc, mids: stuck.map((p) => p.mid) });
+                }
+                continue; // hold — never a timeout-retire (§7.5 rule 2)
+            }
+            this.dropGhost(sourceKey, ghost);
+        }
+    }
+    /** Drop one cleared ghost (§4.2 end state): detach every promoted table's room source (D2
+     *  stay-merged — `removeRoomSource` reconciles each held pk to daemon-or-vanish, value-equal
+     *  under the fence, so visually a no-op), release the {@link promotedTables} record for tables
+     *  no OTHER room/ghost still holds, then run ONE daemon reconcile so entries whose writes had
+     *  staged onto the ghost slice re-invoke and re-stage by provenance onto the daemon slice (the
+     *  removal took their staged copies with the tree; provenance now answers daemon). The whole
+     *  drop runs under one commit boundary so the removal's compensating deltas and the re-staged
+     *  predictions notify as ONE step. After this, a FUTURE upgrade of the same doc promotes
+     *  again from scratch — the round trip is pinned by the §8.5 lanes. */
+    dropGhost(sourceKey, ghost) {
+        this.ghosts.delete(sourceKey);
+        // Re-stage eligibility FIRST: a pending entry staged (only) on the ghost slice must join the
+        // daemon reconcile below (the cycle filter is `touchedSources.has(sourceKey)`) — union, never
+        // shrink, the §5.3 rule.
+        let restage = false;
+        for (const p of this.pendingMutations) {
+            if (p.touchedSources.has(sourceKey)) {
+                p.touchedSources.add("daemon");
+                restage = true;
+            }
+        }
+        this.inOneCommit(() => {
+            for (const table of ghost.tables)
+                this.local.removeRoomSource(table, sourceKey);
+            for (const table of ghost.tables) {
+                let held = false;
+                for (const byTable of this.roomRouting.values())
+                    if (byTable.has(table))
+                        held = true;
+                for (const g of this.ghosts.values())
+                    if (g.tables.includes(table))
+                        held = true;
+                if (!held)
+                    this.promotedTables.delete(table);
+            }
+            // One daemon reconcile replays the re-staged entries onto the daemon slice. Run whenever
+            // any pending exists: the removal above may have taken a staged write with the tree even
+            // when `touchedSources` never recorded the ghost (defensive; an empty-pending drop skips).
+            if (restage || this.pendingMutations.length > 0)
+                this.runReconcileCycle("daemon", []);
+        });
+        this.refreshPending(); // the reconcile may have dropped a throwing re-invocation
+    }
+    // --- the §4 lifecycle SYSTEM-STREAM retains (Slice I-iii) ------------------------------
+    /** Retain one minted SYSTEM subscription (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §4, Slice
+     *  I-iii): a wire sub with NO store view and NO user-visible table. Registered through the same
+     *  {@link RemoteSub} bookkeeping as any remote retain — so qid→channel ownership, the overflow
+     *  re-subscribe, and refcounted release all work unchanged — but with an EMPTY `localQids` set
+     *  (no hydration/resultType coupling) and a {@link systemQids} record telling the release path
+     *  which system table this qid's frames carry (`spec.table`) and which scope/doc it was minted
+     *  for (the fold's row filter). Its frames then buffer on the channel's gate exactly like
+     *  {@link LMID_QID}'s and fold at RELEASE time in {@link foldSystemFrames} — riding the SAME
+     *  buffered cv path as the data they co-committed with (fence coherence: an out-of-band
+     *  shortcut would break I-ii's co-commit ordering guarantee).
+     *
+     *  `channel` defaults to `"daemon"` — the system tables live in the DAEMON store (that is the
+     *  point: outcome/ledger/watermark rows must be readable with no room socket alive, §7.1
+     *  "load-bearing for §7.5"). Idempotence per (table, scope/doc) is the CALLER's job (client.ts
+     *  keys its retains on exactly that); a duplicate retain of the SAME remote identity refcounts
+     *  like any sub. */
+    retainSystemQuery(retainQid, remote, spec, channel = "daemon") {
+        const gate = this.requireGate(channel); // throw loudly BEFORE any sub state moves
+        const key = remoteKey(remote);
+        let sub = this.remoteSubs.get(key);
+        if (sub) {
+            if (sub.channel !== channel) {
+                throw new Error(`optimistic backend: system query "${remote.name}" is already retained on channel ${JSON.stringify(sub.channel)} — cannot retain it on ${JSON.stringify(channel)}`);
+            }
+            sub.refCount++;
+            this.localToRemote.set(retainQid, key);
+            this.remoteRetainToLocal.set(retainQid, undefined);
+            return;
+        }
+        // A fresh sub: deliberately NOT `retainRemote` — its `localQueryId` default would couple this
+        // retain's qid to the view-hydration machinery (`hydrated`/`resultType`), and a system stream
+        // has no view to hydrate.
+        sub = { sourceQid: retainQid, remote, refCount: 1, localQids: new Map(), hydrated: false, channel };
+        this.remoteSubs.set(key, sub);
+        this.sourceToRemote.set(retainQid, key);
+        this.localToRemote.set(retainQid, key);
+        this.remoteRetainToLocal.set(retainQid, undefined);
+        this.systemQids.set(retainQid, { ...spec });
+        gate.source.registerQuery(retainQid, remote);
+    }
+    /** Release a {@link retainSystemQuery} retain. Refcounted like any sub; the LAST release
+     *  unregisters from the owning channel, sweeps its buffered frames, and drops the
+     *  {@link systemQids} record. The folded lifecycle STATE (`roomWatermarks`/`scopeSessions`/
+     *  processed outcomes) deliberately survives — the fence is monotone truth about the store, not
+     *  about the subscription (a re-retained fence must not forget a cleared watermark). */
+    releaseSystemQuery(retainQid) {
+        const remoteQid = this.releaseRemote(retainQid);
+        if (remoteQid === undefined)
+            return; // still refcounted (or unknown)
+        for (const gate of this.gates.values()) {
+            gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
+        }
+        this.systemQids.delete(remoteQid);
     }
     /** Raw CRUD has no optimistic story (§9 replaces it with named mutators). Register a
      *  mutator — even a trivial one — and `invoke` it. */
@@ -319,9 +849,31 @@ export class OptimisticBackend {
      *  straight to the local engine, OUTSIDE the optimistic pending stack — a local table is
      *  untracked, so it never rebases, reverts, or waits on a confirmation. Rejects a synced/tracked
      *  table (the local engine's `writeLocal` is the chokepoint). Reconcile is synchronous and
-     *  non-reentrant (A5), so a local write can never interleave with an open server cycle. */
+     *  non-reentrant (A5), so a local write can never interleave with an open server cycle.
+     *
+     *  Fires the {@link onLocalWrite} observer AFTER the engine commit but BEFORE subscriber
+     *  delivery — i.e. for exactly the batches that passed the M2 guard and committed (the
+     *  persistence layer's write-through tap, `207-LOCAL-TABLE-PERSISTENCE-DESIGN.md` §5.1). A
+     *  subscriber throwing during delivery re-raises out of this call, but only after the tap has
+     *  seen the batch: a committed write can never be invisible to the persistence plane. */
     writeLocal(mutations) {
-        this.local.writeLocal(mutations);
+        this.local.writeLocal(mutations, () => this.localWriteObserver?.(mutations));
+    }
+    /** The write-through tap for the local-persistence layer (207 §5.1): `observer` sees every
+     *  {@link writeLocal} batch post-commit. One observer (the layer); a later registration
+     *  replaces it. The observer must not throw — a persistence failure degrades durability, never
+     *  the write path (P9); the layer catches internally. */
+    onLocalWrite(observer) {
+        this.localWriteObserver = observer;
+    }
+    /** Apply a REPLICATED local batch (a restore snapshot / a leader `commit` — 207 §5.1): delegates
+     *  to the engine's `writeLocal`, so the M2 locality guard still fires (P8 — a corrupt record
+     *  naming a synced table dies loudly here), but does NOT invoke the {@link onLocalWrite}
+     *  observer — the echo guard is structural, so the persistence layer can never re-enter itself.
+     *  `onCommitted` fires post-commit pre-delivery (same anchor as {@link writeLocal}'s tap): the
+     *  layer updates its mirror there, so a subscriber throw can never desync mirror from engine. */
+    applyLocalReplica(mutations, onCommitted) {
+        this.local.writeLocal(mutations, onCommitted);
     }
     onEvent(handler) {
         this.handler = handler;
@@ -366,10 +918,229 @@ export class OptimisticBackend {
             mutator(tx, args);
         }
     }
+    /** Deal the next wire mid from `domain`'s ledger (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md
+     *  §7.1) and advance that counter. A domain absent from the map starts at 1. Per-domain, so a
+     *  client writing through room + daemon concurrently keeps two gapless, non-aliasing sequences.
+     *  The client-global `seq` is stamped in the same breath — the ONE cross-domain total order
+     *  (confirmation order is per-domain; replay order is client-global). Bundled here so no call
+     *  site can deal a mid without its seq. ONE caller discards the seq deliberately: the H-v deopt
+     *  flip ({@link handleMutationOutcome}) keeps the entry's ORIGINAL seq — its replay position —
+     *  and takes only the fresh mid (the dealSeq bump is harmless: seq consumers order, never
+     *  count). */
+    dealMid(domain) {
+        const mid = this.nextMid.get(domain) ?? 1;
+        this.nextMid.set(domain, mid + 1);
+        return { mid, seq: ++this.dealSeq };
+    }
+    // --- the §3 prove-or-slow-path ROUTER (H-iii) -----------------------------------
+    //
+    // RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §3: a mutation routes to room R iff every row its
+    // prediction run WROTE is provably inside R's writable scope and every read it RECORDED is
+    // provably covered by R's footprint — ANY unproven condition routes slow (the §0 asymmetry:
+    // mis-guessing "slow" costs one round-trip; mis-guessing "room" would commit divergent data).
+    // Failure is therefore SILENT "daemon" — never a throw, never a warning per call — plus the Q6
+    // per-reason counters ({@link RoutingInspect}).
+    //
+    // The proof evaluates against the ENGINE wherever the engine has an answer: `writableMatches`
+    // (the registered compiled writable scope — the same predicate the merge's winner tiering uses)
+    // and `provenanceOf` (the visible overlay-first winner). It runs AFTER the prediction committed,
+    // so the probes see the prediction's own staged effects — which only ever strengthens the
+    // conservative direction (a fresh pk reports "daemon"/undefined and neither disqualifies).
+    //
+    // ** THE ONE CLIENT-SIDE NON-ENGINE EVALUATOR — deliberately minimal (the TS evaluation
+    // caveat). ** Evaluating `footprintWhere` on a read's pk cells ({@link evalFootprintOnPk}) is
+    // the single place Slice H allows a non-engine evaluator, and it is restricted to STRICT cell
+    // equality only: `simple` `=` / `!=` between a pk column and a same-primitive-type non-null
+    // literal, composed under and/or (the empty AND is the vacuous-true exact-unconstrained-root
+    // emission and evaluates true). ANY other op or shape — LIKE, <, >=, IS, IN, null operands,
+    // cross-type comparisons, column-vs-column — is NOT EVALUABLE and fails to the daemon.
+    // Justification: a mis-evaluation here cannot commit divergence — the room GATE (H-iv) re-proves
+    // every write and absent read engine-side at commit and deopts, so a wrong client verdict only
+    // costs a wasted hop (route room → gate deopt) or a skipped optimization (route daemon); and
+    // restricting to strict equality on non-null, same-typed pk cells removes the entire
+    // null/collation/coercion divergence space between this evaluator and the engine's comparators.
+    // The gate remains the contract; this router is the optimization.
+    //
+    // ** H-v (SHIPPED — the router's missing recovery half). ** A derived (or pinned) room route
+    // whose gate DEOPTS (the H-iv-b `mutationOutcome {kind:"deopt"}` frame — the mid is burnt in
+    // the room ledger, no effects committed) is re-enqueued onto the daemon stream by
+    // {@link handleMutationOutcome}: the entry flips in place (fresh daemon mid, ORIGINAL seq,
+    // prediction applied throughout), or — already retired — re-invokes from the frame's echoed
+    // name/args pinned to the daemon. A reconnect re-sends unconfirmed mids so a frame lost with
+    // its socket is re-answered ({@link resendPending}). A wrong client verdict therefore costs
+    // exactly one room round-trip plus one burnt room-mid (§3.3), never a stranded prediction.
+    /** The route decision for one invocation (invoke, and again at fold flush): the explicit
+     *  `domainPolicy` is the OVERRIDE — a string pins that domain verbatim, no proof runs;
+     *  `undefined` (or no policy configured) derives per §3. */
+    resolveDomain(name, args, writes, reads) {
+        const pinned = this.domainPolicy(name, args);
+        if (pinned !== undefined)
+            return pinned;
+        return this.deriveDomain(writes, reads);
+    }
+    /** §9.3: does this fold's write-set route into a room (vs the daemon)? Used ONLY to pick the
+     *  {@link FoldOptions.roomDebounceMs} cadence at a fold window's start. It probes
+     *  {@link resolveDomain} but RESTORES the Q6 routing diagnostics afterward — the authoritative
+     *  route and its single counter bump belong to the flush ({@link flushFold}), not to this
+     *  interval hint. A fold's reads are provably empty (the read-trap arms on that path), so the
+     *  write-set alone decides. */
+    routesToRoom(name, args, writes) {
+        const reasons = [...this.routingReasons];
+        const derived = [...this.routingDerived];
+        const domain = this.resolveDomain(name, args, writes, { reads: [], queries: [] });
+        this.routingReasons.clear();
+        for (const [k, v] of reasons)
+            this.routingReasons.set(k, v);
+        this.routingDerived.clear();
+        for (const [k, v] of derived)
+            this.routingDerived.set(k, v);
+        return domain !== "daemon";
+    }
+    /** Count one derivation failure ({@link RoutingInspect}). Returns `false` so the per-candidate
+     *  proof's call sites read `return this.failDerivation(...)`. */
+    failDerivation(reason) {
+        this.routingReasons.set(reason, (this.routingReasons.get(reason) ?? 0) + 1);
+        return false;
+    }
+    /** The §3 derivation. Candidates are the connected room gates with at least one promoted table
+     *  (a promoted table with no gate cannot confirm; a gate with no promoted table holds no data to
+     *  prove against). Zero candidates ⇒ `"daemon"` (the single-domain fast path). The proof runs
+     *  per candidate and EXACTLY ONE must survive — two rooms both proving routes slow (principled
+     *  disambiguation is a §9.2 multi-room NON-goal, deferred past Slice J; slow is always sound). */
+    deriveDomain(writes, reads) {
+        const candidates = [];
+        for (const key of this.gates.keys()) {
+            if (key === "daemon")
+                continue;
+            if ((this.roomRouting.get(key)?.size ?? 0) > 0)
+                candidates.push(key);
+        }
+        if (candidates.length === 0) {
+            this.failDerivation("no-candidates");
+            return "daemon";
+        }
+        // tx.query is not room-executable client-side: predicate containment (rindle-cover) is
+        // native-only BY DESIGN, so a declarative read fails the WHOLE derivation unconditionally.
+        // This is required, not conservative.
+        if (reads.queries.length > 0) {
+            this.failDerivation("tx-query");
+            return "daemon";
+        }
+        const proven = candidates.filter((room) => this.provesRoom(room, writes, reads));
+        if (proven.length === 1) {
+            const room = proven[0];
+            this.routingDerived.set(room, (this.routingDerived.get(room) ?? 0) + 1);
+            return room;
+        }
+        if (proven.length > 1)
+            this.failDerivation("ambiguous");
+        return "daemon"; // zero survivors: each candidate already counted its own failure reason
+    }
+    /** One candidate room's §3 proof over the captured write-set + read-log. Every write must pass
+     *  ALL the write rules; every read must pass ONE of the read rules. First failure wins (and is
+     *  counted); order is deterministic (write-set map order, then read-log order). */
+    provesRoom(room, writes, reads) {
+        const specs = this.roomRouting.get(room);
+        // --- write rules: every WriteRecord passes ALL of #1–#4 -------------------------------
+        for (const [table, byPk] of writes) {
+            // #1: the table is promoted for R with a writable (predicate-kind) spec. A context table
+            // (`writable: none`), an un-promoted table, and a local table (unreachable — the mutator
+            // guard refuses local writes at stage time) all fail here.
+            const spec = specs?.get(table);
+            if (spec === undefined || !spec.writable)
+                return this.failDerivation("write-unwritable-table");
+            const colIx = this.colIndex[table];
+            for (const rec of byPk.values()) {
+                const removeShape = rec.row === undefined;
+                // #2: the registered writable scope, evaluated BY THE ENGINE on the post-image for
+                // add/edit shapes and on the pre-image for removes (the row the room would delete). A
+                // remove record always carries its full-width pre-image (the H-ii capture contract);
+                // a violated contract fails closed rather than probing nothing.
+                const scopeRow = removeShape ? rec.oldRow : rec.row;
+                if (scopeRow === undefined || !this.local.writableMatches(table, room, scopeRow)) {
+                    return this.failDerivation("write-scope-miss");
+                }
+                // #3: join-key no-change. An edit-shape (row + oldRow — the oldRow is the txn-entry base)
+                // must keep every joinKeyCols cell STRICTLY identical old-vs-new; an add-shape may SET
+                // them (it creates the correlation); removes are exempt. A join-key column missing from
+                // the schema is a spec bug — fail closed.
+                if (!removeShape && rec.oldRow !== undefined) {
+                    for (const col of spec.joinKeyCols) {
+                        const i = colIx?.get(col);
+                        if (i === undefined || !identicalCell(rec.oldRow[i], rec.row[i])) {
+                            return this.failDerivation("write-join-key-change");
+                        }
+                    }
+                }
+                // #4: provenance corroboration — the engine routes an Edit by its OLD row (H-i), so probe
+                // the pre-image for edit/remove shapes and the post-image for add-shapes. A winner naming
+                // a DIFFERENT room disqualifies; "daemon"/undefined does NOT (a thin slice, or a fresh pk
+                // — fresh pks stage to the daemon slice by the E2 decision, kept permanently: the
+                // room-side authoritative run is the committing execution either way).
+                const probeRow = rec.oldRow ?? rec.row;
+                if (probeRow !== undefined) {
+                    const src = this.local.provenanceOf(table, probeRow);
+                    if (src !== undefined && src !== "daemon" && src !== room) {
+                        return this.failDerivation("write-cross-room-provenance");
+                    }
+                }
+            }
+        }
+        // --- read rules: every ReadRecord passes ONE ------------------------------------------
+        // (tx.query already failed the whole derivation in deriveDomain — never reaches here.)
+        for (const r of reads.reads) {
+            // Self-read: the pk is in THIS invocation's write-set for that table — the write rules
+            // above already judged it (covers the keyed writers' probe-then-write shape). NOTE the
+            // read-log reflects the ORIGINAL invoke only (the pre-existing capture caveat).
+            if (writes.get(r.table)?.has(stableJson(r.pk)))
+                continue;
+            if (r.source !== undefined) {
+                if (r.source === room)
+                    continue; // the room served the row — in-footprint by construction
+                if (r.source !== "daemon")
+                    return this.failDerivation("read-cross-room");
+            }
+            // Present-with-daemon/undefined source, or ABSENT (source is never recorded for those —
+            // including the un-promoted-table meaning of an absent key): the footprint-membership test
+            // on the PK ALONE. R's footprintWhere must exist, be key-decidable (every column it reads is
+            // a pk column), and evaluate TRUE on the read's pk cells:
+            //   present-daemon + TRUE  ⇒ the row is in the room's COMPLETE footprint ⇒ covered;
+            //   absent + TRUE          ⇒ absent-in-room = absent-in-truth ⇒ covered;
+            //   FALSE (either outcome) ⇒ fail — present-daemon-FALSE means the room lacks the row;
+            //     absent-FALSE is arguably provable (decidably-outside ⇒ the room never sees the pk)
+            //     but the room-side run would then read absent for a DIFFERENT reason than truth's —
+            //     stay CONSERVATIVE and fail;
+            //   no footprintWhere / not key-decidable / not evaluable ⇒ fail (see the evaluator caveat
+            //     on the router block comment).
+            const fw = specs?.get(r.table)?.footprintWhere;
+            if (fw === undefined)
+                return this.failDerivation("read-no-footprint-where");
+            const tspec = this.specs[r.table];
+            const pkCols = tspec.primaryKey.map((i) => tspec.columns[i]);
+            if (!keyDecidable(fw, new Set(pkCols)))
+                return this.failDerivation("read-not-key-decidable");
+            const pkCells = new Map(pkCols.map((c, j) => [c, r.pk[j]]));
+            const verdict = evalFootprintOnPk(fw, pkCells);
+            if (verdict === undefined)
+                return this.failDerivation("read-not-evaluable");
+            if (!verdict)
+                return this.failDerivation("read-outside-footprint");
+        }
+        return true;
+    }
     /** Run the named client mutator optimistically: the prediction applies to the live
      *  engine now (affected views update synchronously), `(mid, name, args)` joins the
      *  pending stack, and the envelope ships upstream. Returns the assigned `mid`. */
     invoke(name, args) {
+        return this.invokeWith(name, args);
+    }
+    /** {@link invoke} with an optional PINNED confirming domain (H-v): the deopt handshake's
+     *  already-retired arm re-invokes the frame's echoed `(name, args)` as a FRESH invocation pinned
+     *  to `"daemon"` — an honest re-prediction on the current base, never derived (`pin` bypasses
+     *  {@link resolveDomain} entirely, so the router never runs and no Q6 counter moves). Every
+     *  other step is `invoke` verbatim: prediction now, capture, drainOverlapping, mid dealt from
+     *  the pinned domain's ledger, envelope on its channel. */
+    invokeWith(name, args, pin) {
         const mutator = this.registry[name];
         if (!mutator)
             throw new Error(`unknown client mutator: ${name}`);
@@ -380,18 +1151,39 @@ export class OptimisticBackend {
             // the staged write is discarded (the wasm txn is a clean no-op until commit) and the throw
             // propagates with NO mid consumed — a burnt mid is a permanent server-side gap that
             // silently refuses every later mutation from this client (#10).
-            const touched = new Set();
+            const writes = new Map();
+            const reads = { reads: [], queries: [] };
             const ops = [];
-            this.local.writeWith((tx) => {
-                this.runMutator(mutator, trackingTx(tx, touched, this.specs, this.localTables, this.opCollector(ops)), args);
+            // Per-staged-write source keys (staged order), zipped with the `commitTracked` `sources[]`
+            // below to learn which physical source each pk routed onto (§5.3 filter + §7.3 hold-back).
+            const stagedKeys = [];
+            const sources = this.local.writeWith((tx) => {
+                this.runMutator(mutator, 
+                // `readProvenance` rides only with recording (H-ii §3.2 #3): the folded path (trap, no
+                // readLog) and the reconcile replay (no readLog) never probe — see trackingTx.
+                trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, reads, stagedKeys, this.readProvenance), args);
             });
+            // `touched` is DERIVED, never separately populated (§3.2 #1) — see {@link WriteSet}.
+            const touched = new Set(writes.keys());
             // Flush-on-enqueue (§4.2): a fold whose tables overlap this write must take its mid NOW, BEFORE
             // this write does, so wire order == local-apply order for any pair that can observe each other
             // (a read-dependent write reading a folded cell sees the same value optimistically and on the
             // wire — no snap). Drained folds ship with smaller mids; this write's mid is dealt after.
             this.drainOverlapping(touched);
-            const mid = this.nextMid++;
-            this.pendingMutations.push({ mid, name, args, touched });
+            // The confirming stream (§7.1): its ledger deals the mid and its watermark alone retires the
+            // entry. THE §3 ROUTER RUNS HERE (H-iii) — after the prediction (write/read capture is
+            // complete, and the engine holds the committed prediction the probes read) and BEFORE the
+            // mid is dealt: an assigned mid pins its domain forever (§7.1) — a re-invocation never
+            // re-routes. An explicit `domainPolicy` string pins verbatim (no proof); an H-v deopt
+            // re-invocation pins via `pin` (see {@link invokeWith}) and the router never runs.
+            const domain = pin ?? this.resolveDomain(name, args, writes, reads);
+            const { mid, seq } = this.dealMid(domain);
+            // The write-source axes (§5.3): which physical source each write staged onto. All `"daemon"`
+            // in single-domain (Collapsed) — so the filter and hold-back below are inert on the live path.
+            const touchedSources = new Set(sources);
+            const writeSources = new Map();
+            mergeWriteSources(writeSources, stagedKeys, sources);
+            this.pendingMutations.push({ mid, seq, name, args, domain, touched, writes, reads, touchedSources, writeSources });
             // The prediction stuck — fold its child ops into the optimistic agg delta and push it onto
             // the `__agg` head rows (§4). No reset here (this is the §1.3 trivial case, no rewind): the
             // delta accumulates on top of the prior pending set, and `reconcileAggHead` recomputes each
@@ -400,7 +1192,7 @@ export class OptimisticBackend {
                 this.overlay.observe(op);
             this.reconcileAggHead();
             this.refreshPending(); // §7.2: this write now touches its queries' pending axis (NOT ResultType).
-            void this.source.pushMutation({ clientID: this.clientID, mid, name, args });
+            void this.channelFor(domain).pushMutation({ clientID: this.clientID, mid, name, args });
             return mid;
         });
     }
@@ -418,12 +1210,15 @@ export class OptimisticBackend {
         return this.inOneCommit(() => {
             // Apply the prediction with the read trap armed (§5): a folded mutator that reads state to
             // compute its write is non-absorbing and refused. A throw discards the staged write (clean
-            // no-op) and consumes no mid — exactly `invoke`'s guarantee.
-            const touched = new Set();
+            // no-op) and consumes no mid — exactly `invoke`'s guarantee. NO `readLog` here — the trap
+            // path stays byte-for-byte as it was; recording (§3.2 #2) never arms alongside the trap.
+            const writes = new Map();
             const ops = [];
+            const stagedKeys = [];
+            let sources = [];
             try {
-                this.local.writeWith((tx) => {
-                    this.runMutator(mutator, trackingTx(tx, touched, this.specs, this.localTables, this.opCollector(ops), true), args);
+                sources = this.local.writeWith((tx) => {
+                    this.runMutator(mutator, trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), true, undefined, stagedKeys), args);
                 });
             }
             catch (e) {
@@ -435,6 +1230,13 @@ export class OptimisticBackend {
             for (const op of ops)
                 this.overlay.observe(op);
             this.reconcileAggHead();
+            // `touched` is DERIVED, never separately populated (§3.2 #1) — see {@link WriteSet}.
+            const touched = new Set(writes.keys());
+            // The write-source axes (§5.3), like `touched`/`writes` — REPLACED wholesale on an in-place
+            // fold overwrite (the latest invocation supersedes, absorbing), initialized on a new entry.
+            const touchedSources = new Set(sources);
+            const writeSources = new Map();
+            mergeWriteSources(writeSources, stagedKeys, sources);
             const now = this.clock.now();
             let f = this.folds.get(foldKey);
             if (f) {
@@ -443,11 +1245,25 @@ export class OptimisticBackend {
                 // only the LATEST args, which is what a rebase re-derives from and what the flush ships.
                 f.entry.args = args;
                 f.entry.touched = touched;
+                f.entry.writes = writes;
+                f.entry.touchedSources = touchedSources;
+                f.entry.writeSources = writeSources;
                 f.args = args;
                 this.clock.clearTimeout(f.timer);
             }
             else {
-                const entry = { mid: null, name, args, touched };
+                // Provisional domain (§7.1): re-resolved from the final args/write-set at flush, when the
+                // mid is dealt. Never read before then — an un-flushed fold (`mid == null`) is
+                // unconditionally retained — so the full (counting) derivation deliberately does NOT run
+                // here (it would double-bump the Q6 counters for one logical route); the flush derives.
+                const domain = this.domainPolicy(name, args) ?? "daemon";
+                // §9.3: pick the window's cadence. Routing into a room ⇒ flush at roomDebounceMs so
+                // intermediates stream to the shared head; off the room, the caller's collapse debounce
+                // governs. The probe restores the Q6 diagnostics (the flush owns the authoritative bump).
+                const inRoom = opts.roomDebounceMs !== undefined && this.routesToRoom(name, args, writes);
+                const debounceMs = inRoom ? opts.roomDebounceMs : opts.debounceMs ?? DEFAULT_FOLD_DEBOUNCE_MS;
+                const maxWaitMs = inRoom ? opts.roomDebounceMs : opts.maxWaitMs;
+                const entry = { mid: null, seq: null, name, args, domain, touched, writes, reads: { reads: [], queries: [] }, touchedSources, writeSources };
                 this.pendingMutations.push(entry);
                 let resolveMid;
                 const midPromise = new Promise((res) => (resolveMid = res));
@@ -456,8 +1272,8 @@ export class OptimisticBackend {
                     args,
                     timer: undefined,
                     firstAt: now,
-                    debounceMs: opts.debounceMs ?? DEFAULT_FOLD_DEBOUNCE_MS,
-                    maxWaitMs: opts.maxWaitMs,
+                    debounceMs,
+                    maxWaitMs,
                     deferAcrossWrites: opts.deferAcrossWrites ?? false,
                     midPromise,
                     resolveMid,
@@ -499,11 +1315,166 @@ export class OptimisticBackend {
             return;
         this.clock.clearTimeout(f.timer);
         this.folds.delete(foldKey);
-        const mid = this.nextMid++;
+        // Resolve the confirming stream from the FINAL args (§7.1) and deal the mid from that domain's
+        // ledger — SEND order, never reserved, so gapless within the domain. Under H-iii derivation
+        // this RE-DERIVES from the entry's LATEST write-set (each in-place fold overwrite replaced it,
+        // so it reflects the final absorbed value): same §3 rules minus reads — a fold's read-set is
+        // provably empty by construction (the FoldReadError trap, not recording, arms on that path),
+        // which is the STRONGEST read proof there is. The mid dealt below then pins this domain.
+        const domain = this.resolveDomain(f.entry.name, f.args, f.entry.writes, f.entry.reads);
+        f.entry.domain = domain;
+        const { mid, seq } = this.dealMid(domain);
         f.entry.mid = mid;
-        void this.source.pushMutation({ clientID: this.clientID, mid, name: f.entry.name, args: f.args });
+        f.entry.seq = seq;
+        void this.channelFor(domain).pushMutation({ clientID: this.clientID, mid, name: f.entry.name, args: f.args });
         f.resolveMid(mid);
     }
+    /** The transport a `domain`-confirmed mutation ships on (§7.5 sent-pins-domain: only the
+     *  domain's own authority can confirm it, so its channel is the only correct transport). A
+     *  domain with NO connected gate ships on the daemon channel — the gate-less configurations
+     *  (`__testRelease`-driven tests) and today's entire live path resolve `"daemon"` anyway. */
+    channelFor(domain) {
+        return (this.gates.get(domain) ?? this.daemonGate).source;
+    }
+    /** The gate a channel-keyed retain registers through (G-iii registration-time routing). The
+     *  channel MUST already be connected (`connectSource`; the daemon is constructor-attached) —
+     *  loud by design: a typo'd or not-yet-connected sourceKey must throw at retain time, never
+     *  silently register on the daemon and split the query's frames across channels. */
+    requireGate(channel) {
+        const gate = this.gates.get(channel);
+        if (!gate) {
+            throw new Error(`optimistic backend: no source connected for channel ${JSON.stringify(channel)} — call connectSource(${JSON.stringify(channel)}, source) before retaining a query on it`);
+        }
+        return gate;
+    }
+    /** The channel that owns `sourceQid` — {@link RemoteSub.channel}, the ONE source of truth for
+     *  qid routing (G-iii). `undefined` when no sub owns the qid (a harness-delivered raw feed, or
+     *  a just-released sub): such frames buffer on whatever gate they arrive at. */
+    channelOf(sourceQid) {
+        const key = this.sourceToRemote.get(sourceQid);
+        return key ? this.remoteSubs.get(key)?.channel : undefined;
+    }
+    // --- the §3.3 deopt handshake, client half (H-v) ---------------------------------
+    //
+    // THE NAMED INVARIANT (Slice I inherits it): **never retire a room-domain entry off a
+    // daemon-carried lmid without outcome resolution.** On the room socket it holds by
+    // construction: every room lmid folds through the room's OWN gate, whose socket also carries
+    // the outcome frames — same-socket ordering puts the frame before the ack, and the reconnect
+    // re-send re-earns a lost frame, so a room-domain entry is only ever retired as a success when
+    // the room really applied it. Slice I's downgrade path breaks that coupling: the doc-scoped
+    // ledger row becomes readable THROUGH THE DAEMON with no room socket alive (§7.1 "load-bearing
+    // for §7.5"), and an lmid adopted that way covers burnt non-applied mids with no frame to say
+    // so — retiring a deopted entry there as a silent success is exactly the lost-write this
+    // handshake exists to prevent. ENFORCED since I-iii by {@link foldSystemFrames}: the I-ii
+    // outcome ROWS (co-committed, in ONE daemon transaction, with the ledger row that covers them)
+    // are synthesized into frames and routed through THIS machine BEFORE the ledger fold advances
+    // the domain watermark — one verdict path for frames and rows, with the processed set as the
+    // cross-release resolved-verdict memory, and absence-under-a-covering-lmid = applied (I-ii's
+    // atomicity makes that the sound default).
+    /** Record `(domain, mid)` as processed; `false` if it already was (a duplicate frame —
+     *  ignore it). FIFO-capped per domain ({@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}). */
+    markOutcomeProcessed(domain, mid) {
+        let mids = this.outcomesProcessed.get(domain);
+        if (!mids)
+            this.outcomesProcessed.set(domain, (mids = new Set()));
+        if (mids.has(mid))
+            return false;
+        mids.add(mid);
+        while (mids.size > MAX_PROCESSED_OUTCOMES_PER_DOMAIN) {
+            mids.delete(mids.values().next().value);
+        }
+        return true;
+    }
+    /** One `mutationOutcome` frame from `domain`'s channel (H-v — the §3.3 handshake's client
+     *  half). The frame arrives OUT-OF-BAND (see {@link attachGate}); the state machine:
+     *
+     *  1. `mid` never issued on `domain` ⇒ ignore (a confused/foreign frame must not invent work).
+     *  2. `(domain, mid)` already processed ⇒ ignore — idempotence under duplicate frames (the
+     *     original + a re-send's re-answer; a deopt for a mid whose entry ALREADY FLIPPED also
+     *     lands here harmlessly on its second frame).
+     *  3. `kind:"rejected"` ⇒ FINAL. Surface the reason through {@link rejectedHandler} (room-plane
+     *     parity with the HTTP queue's callback) and STOP — the drop + snap-back is the EXISTING
+     *     failed-mutation machinery: the room burnt the mid, its lmid release retires the entry
+     *     per-domain and the reconcile rewinds the prediction, exactly the daemon path's
+     *     processed-as-no-op rejection. No new drop path.
+     *  4. `kind:"deopt"`, entry found (pending `(domain, mid)`) ⇒ FLIP IN PLACE: `domain` becomes
+     *     `"daemon"`, a fresh daemon mid is dealt and the envelope ships NOW on the daemon channel
+     *     ("deal-and-send-now" — the conforming §3.3 re-enqueue: there is no flush machinery for
+     *     non-fold entries, so the design's "mid: null until the daemon flush" is satisfied
+     *     momentarily inside this call). THE ENTRY'S `seq` IS KEPT — settled (§5.3, commit
+     *     68141096): `seq` is the client-global REPLAY order; re-sequencing would move the entry's
+     *     overlay position and change read-dependent SIBLINGS' replay base. Everything else stays
+     *     (writes/reads/touched/touchedSources/writeSources — union-never-shrink), the prediction
+     *     stays applied (the entry never leaves `pendingMutations`, so no rewind fires), and the
+     *     router does NOT re-run nor does `drainOverlapping` (§3.3 re-enqueues, never re-derives;
+     *     any open overlapping fold was invoked later and flushes later with a larger mid).
+     *  5. `kind:"deopt"`, entry NOT found ⇒ the burnt-mid confirm won the race, or the frame is a
+     *     replay re-answer for an entry a previous session retired (the replay gotcha): re-invoke
+     *     the frame's echoed `name`/`args` as a FRESH invocation PINNED to `"daemon"` — an honest
+     *     re-prediction on the current base, never a derived route ({@link invokeWith}). A frame
+     *     without `name` (not self-contained) has nothing to re-invoke and is dropped; a re-invoke
+     *     that THROWS (the base moved from under it) is surfaced through {@link rejectedHandler} —
+     *     the mutation is dead with no stream left to confirm it.
+     *
+     *  A `"deopt"` bump joins the Q6 routing counters either way (`routing.reasons.deopt`) —
+     *  derived-and-deopted routes are visible beside derived successes. */
+    handleMutationOutcome(domain, frame) {
+        if (frame.mid >= (this.nextMid.get(domain) ?? 1))
+            return; // never issued here — not ours
+        if (!this.markOutcomeProcessed(domain, frame.mid))
+            return; // duplicate frame
+        if (frame.kind === "rejected") {
+            const entry = this.pendingMutations.find((p) => p.domain === domain && p.mid === frame.mid);
+            this.rejectedHandler({
+                clientID: this.clientID,
+                mid: frame.mid,
+                name: entry?.name ?? frame.name ?? "",
+                args: entry !== undefined ? entry.args : frame.args,
+            }, frame.reason ?? "mutation rejected");
+            return;
+        }
+        // kind === "deopt": Q6's completion — how often a routed mutation came back refused.
+        this.routingReasons.set("deopt", (this.routingReasons.get("deopt") ?? 0) + 1);
+        const entry = this.pendingMutations.find((p) => p.domain === domain && p.mid === frame.mid);
+        if (entry) {
+            entry.domain = "daemon";
+            // Deal the fresh daemon mid but DISCARD its seq — the entry keeps its own (state-machine
+            // step 4 above; the harmless dealSeq bump is accepted). This is the ONE place a dealt seq
+            // is dropped, so "within one domain seq order == mid order" weakens to "except deopt
+            // re-enqueues" — see the {@link PendingMutation.seq} doc.
+            const { mid } = this.dealMid("daemon");
+            entry.mid = mid;
+            void this.channelFor("daemon").pushMutation({ clientID: this.clientID, mid, name: entry.name, args: entry.args });
+            return;
+        }
+        if (frame.name === undefined)
+            return; // not self-contained — nothing to re-invoke
+        try {
+            this.invokeWith(frame.name, frame.args, "daemon");
+        }
+        catch (err) {
+            this.rejectedHandler({ clientID: this.clientID, mid: frame.mid, name: frame.name, args: frame.args }, `deopt re-invocation failed: ${String(err?.message ?? err)}`);
+        }
+    }
+    /** §7.5 rule 3 (H-v): re-send `domain`'s unconfirmed pending envelopes with their ORIGINAL
+     *  mids, in mid order, on the domain's own channel. Folds with `mid === null` are excluded —
+     *  nothing was ever sent for them (the flush deals their mid). Envelopes are reconstructed from
+     *  the pending entries exactly as `invoke` shipped them (`clientID`/`mid`/`name`/`args` —
+     *  entries carry everything the wire needs). Idempotent under the domain's ledger: an APPLIED
+     *  mid dedups silently and its lmid coverage retires the entry; a NON-APPLIED mid is re-answered
+     *  from the shell's recorded-outcome map into {@link handleMutationOutcome}. Confirmed entries
+     *  are already gone from `pendingMutations`, so no filter against the watermark is needed. */
+    resendPending(domain) {
+        const unconfirmed = this.pendingMutations
+            .filter((p) => p.domain === domain && p.mid !== null)
+            .sort((a, b) => a.mid - b.mid);
+        if (unconfirmed.length === 0)
+            return;
+        const channel = this.channelFor(domain);
+        for (const p of unconfirmed) {
+            void channel.pushMutation({ clientID: this.clientID, mid: p.mid, name: p.name, args: p.args });
+        }
+    }
     /** Drain every outstanding fold immediately (FOLDED-MUTATIONS-DESIGN §3): the explicit
      *  `app.flushFolds()` and the `beforeunload`/`close` hook. Creation (insertion) order. */
     flushFolds() {
@@ -602,7 +1573,19 @@ export class OptimisticBackend {
         const pending = this.pendingMutations.map((p) => {
             const folded = foldByEntry.get(p);
             const key = p.mid != null ? `m:${p.mid}` : folded ? `f:${folded[0]}` : `?:${p.name}`;
-            const out = { key, mid: p.mid, name: p.name, args: p.args, tables: [...p.touched] };
+            const writes = [];
+            for (const byPk of p.writes.values())
+                for (const rec of byPk.values())
+                    writes.push(rec);
+            const out = {
+                key,
+                mid: p.mid,
+                name: p.name,
+                args: p.args,
+                tables: [...p.touched],
+                writes,
+                reads: { reads: [...p.reads.reads], queries: [...p.reads.queries] },
+            };
             if (folded) {
                 const f = folded[1];
                 out.fold = {
@@ -617,13 +1600,69 @@ export class OptimisticBackend {
         });
         return {
             pending,
-            confirmedLmid: this.confirmedLmid,
-            nextMid: this.nextMid,
-            appliedCv: this.appliedCv,
-            bufferedFrames: this.buffer.length,
+            // Back-compat scalars for the devtools `OptimisticInspect` mirror (unchanged shape): the DAEMON
+            // domain's ledger — the only one in single-domain. Per-domain state is `__inspectDomains()`.
+            confirmedLmid: this.watermark.get("daemon") ?? 0,
+            nextMid: this.nextMid.get("daemon") ?? 1,
+            appliedCv: this.daemonGate.appliedCv,
+            bufferedFrames: this.daemonGate.buffer.length,
             pendingTables: [...this.pendingTables()],
         };
     }
+    /** Test-only per-domain ledger snapshot (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1/§8.5).
+     *  Kept separate from {@link __inspect} so the devtools `OptimisticInspect` mirror stays byte-for-
+     *  byte identical (daemon-scalar-only). Exposes the per-domain `nextMid`/`watermark` maps plus each
+     *  pending entry's confirming domain — the axes the §8.5 ledger-isolation assertion checks. */
+    __inspectDomains() {
+        return {
+            nextMid: Object.fromEntries(this.nextMid),
+            watermark: Object.fromEntries(this.watermark),
+            gates: Object.fromEntries([...this.gates].map(([k, g]) => [
+                k,
+                {
+                    appliedCv: g.appliedCv,
+                    bufferedFrames: g.buffer.length,
+                    ...(g.upstreamCv !== undefined ? { upstreamCv: g.upstreamCv } : {}),
+                    ...(g.upstreamBoot !== undefined ? { upstreamBoot: g.upstreamBoot } : {}),
+                },
+            ])),
+            routing: {
+                derived: Object.fromEntries(this.routingDerived),
+                reasons: Object.fromEntries(this.routingReasons),
+            },
+            lifecycle: {
+                roomWatermarks: Object.fromEntries(this.roomWatermarks),
+                scopeSessions: Object.fromEntries([...this.scopeSessions].map(([scope, sessions]) => [scope, Object.fromEntries(sessions)])),
+                ghosts: Object.fromEntries([...this.ghosts].map(([k, g]) => [k, { doc: g.doc, finalFlushSeq: g.finalFlushSeq, tables: [...g.tables] }])),
+            },
+            pins: Object.fromEntries([...this.pins].map(([k, p]) => [
+                k,
+                {
+                    table: p.table,
+                    sourceKey: p.sourceKey,
+                    domain: p.domain,
+                    mid: p.mid,
+                    ...(p.daemonBoot !== undefined ? { daemonBoot: p.daemonBoot } : {}),
+                    ...(p.daemonCv !== undefined ? { daemonCv: p.daemonCv } : {}),
+                    tripwired: p.tripwired === true,
+                },
+            ])),
+            daemonCarriedLmid: Object.fromEntries(this.daemonCarriedLmid),
+            pending: this.pendingMutations.map((p) => ({
+                mid: p.mid,
+                // The client-global deal sequence — the REPLAY order (mids are per-domain, incomparable
+                // across domains; see PendingMutation.seq). The harness asserts send order with this.
+                seq: p.seq,
+                name: p.name,
+                domain: p.domain,
+                // The write-source axes (§5.3): which physical source(s) this entry's writes routed onto —
+                // the filter basis, and (per pk) the hold-back's cross-slice test. The harness asserts the
+                // filter/routing against its independent model with these.
+                touchedSources: [...p.touchedSources],
+                writeSources: Object.fromEntries(p.writeSources),
+            })),
+        };
+    }
     /** Recompute the pending axis for every query and fire `onPending` on transitions only. Called
      *  from the two points that move the pending set: invoke/invokeFolded (add) and the confirm-drop
      *  (remove) — exactly where `:359`/`:468` used to flip ResultType (§7.3). */
@@ -636,18 +1675,39 @@ export class OptimisticBackend {
             }
         }
     }
-    // --- the downstream stream (§8.5: buffer, then release coherently) ---------------
-    onNormalized(qid, ev) {
-        if (qid !== LMID_QID)
+    // --- the downstream stream (§8.5: buffer, then release coherently — PER GATE, §5.1) ------
+    onFrame(gate, qid, ev) {
+        // Ownership is fixed at RETAIN time (G-iii registration-time routing: {@link RemoteSub.channel},
+        // the one source of truth) — a qid lives on the ONE channel its sub registered on. So a frame
+        // arriving on any OTHER gate means the server routed a qid to the wrong channel: a wiring bug —
+        // fail loudly rather than silently splitting one query's frames across two cv timelines. (This
+        // used to be a lazy first-arrival CLAIM; it is now a pure assertion.) A qid with NO sub (a
+        // harness-delivered raw feed) has no owner and buffers on the arriving gate; the per-channel
+        // reserved LMID_QID is exempt — each gate owns its own.
+        if (qid !== LMID_QID) {
+            const owner = this.channelOf(qid);
+            if (owner !== undefined && owner !== gate.key) {
+                // I-iv retarget grace: a frame already in flight from the sub's PREVIOUS channel when
+                // {@link retargetRemoteQuery} moved it (the unsubscribe races the server's last frames)
+                // is stale, not a wiring bug — drop it. The grace window is exactly the deferred-GC
+                // window: {@link flushRetargetGc} deletes the record, and the loud throw is restored.
+                if (this.pendingRetargetGc.get(qid) === gate.key)
+                    return;
+                throw new Error(`optimistic backend: qid ${qid} arrived on ${gate.key} but is owned by ${owner}`);
+            }
+        }
+        // System-plane frames (I-iii) are bookkeeping, not view data: like the lmid stream they skip
+        // the devtools server-delta tap (there is no local view to attribute them to).
+        if (qid !== LMID_QID && !this.systemQids.has(qid))
             this.emitServerDelta(qid, ev);
         if (ev.type === "hello") {
             // A hello is a (re)subscribe = a NEW epoch. The column map below is mutated eagerly, but
-            // data frames are cv-buffered and drained later (onProgress). So any frame still buffered
-            // for this qid is from a SUPERSEDED epoch and must NOT be scattered through this epoch's
-            // (possibly changed) map — drop it. This epoch's snapshot, which always follows the hello,
-            // re-hydrates the qid from scratch, so the dropped frames are redundant. Scoped to this
-            // qid: other queries' frames (and the lmid system query's) keep their coherent release.
-            this.buffer = this.buffer.filter((f) => f.qid !== qid);
+            // data frames are cv-buffered and drained later (the gate's progress). So any frame still
+            // buffered for this qid is from a SUPERSEDED epoch and must NOT be scattered through this
+            // epoch's (possibly changed) map — drop it. This epoch's snapshot, which always follows the
+            // hello, re-hydrates the qid from scratch, so the dropped frames are redundant. Scoped to
+            // this qid: other queries' frames (and the lmid system query's) keep their coherent release.
+            gate.buffer = gate.buffer.filter((f) => f.qid !== qid);
             this.addServerDependencyTables(qid, ev.tables.map((t) => t.name));
             // Learn this query's per-table column map (PROJECTION-SUPPORT-DESIGN.md §5.2): map each
             // advertised column to its base ColId BY NAME. The hello may carry FEWER columns than the
@@ -667,18 +1727,18 @@ export class OptimisticBackend {
                 // epoch left (a server that expanded then contracted back), so the now-exact rows don't
                 // scatter through a `-1`-bearing layout (silent cell corruption).
                 if (cols.length !== full || cols.some((c, i) => c !== i))
-                    this.sync.registerProjection(qid, t.name, cols);
+                    gate.sync.registerProjection(qid, t.name, cols);
                 else
-                    this.sync.unregisterProjection(qid, t.name);
+                    gate.sync.unregisterProjection(qid, t.name);
             }
             return; // envelope validation is the source's job
         }
         const cv = ev.cv ?? 0;
-        if (cv <= this.appliedCv && ev.type === "batch")
-            return; // stale redelivery
-        this.buffer.push({ cv, qid, kind: ev.type, ops: ev.ops, seq: this.nextSeq++ });
-        if (this.buffer.length > this.bufferCap)
-            this.overflow();
+        if (cv <= gate.appliedCv && ev.type === "batch")
+            return; // stale redelivery ON THIS TIMELINE
+        gate.buffer.push({ cv, qid, kind: ev.type, ops: ev.ops, seq: gate.nextSeq++ });
+        if (gate.buffer.length > this.bufferCap)
+            this.overflow(gate);
     }
     emitServerDelta(sourceQid, ev) {
         if (!this.devObservers.size)
@@ -696,70 +1756,570 @@ export class OptimisticBackend {
         const localQids = [...sub.localQids.keys()];
         return localQids.length ? localQids : [sourceQid];
     }
-    onProgress(frame) {
-        // (1) Take every buffered frame at cv ≤ cvMin, in (cv, arrival) order, and fold it:
-        // lmid system-query frames advance `confirmedLmid`; data frames fold through the
-        // cross-query refcount into ONE net base delta — the §1.3 `D`. Confirmation and
-        // data of the same commit share a cv, so they release together by construction.
-        const ready = this.buffer
+    /** One gate's release (§5.1 release gate): compute the coherent delta from THIS gate's cv-buffer,
+     *  then apply it against the gate's source/domain. Split into {@link computeRelease} (buffer →
+     *  delta, lmid → watermark) and {@link applyRelease} (per-source confirm-drop + reconcile) —
+     *  N independent gates all feed the ONE apply half; {@link __testRelease} drives it directly. */
+    onGateProgress(gate, frame) {
+        // §301 direction B: record the frame's upstream-absorption advert BEFORE the release applies,
+        // so the drop pass at applyRelease's tail evaluates exactly this release's advert — the room
+        // emits data-then-progress on one socket, so by the time the advert says "absorbed through
+        // cv U" the re-published echo data is in this release's fold (never ahead of it). Verbatim,
+        // not max-folded: on a daemon restart the advertised cv space legitimately resets and the
+        // §2.4 boot rule (not monotonicity) carries the ordering.
+        if (frame.upstreamCv !== undefined) {
+            gate.upstreamCv = frame.upstreamCv;
+            gate.upstreamBoot = frame.upstreamBoot;
+        }
+        const { deltas, newlyHydrated, touchedScopes } = this.computeRelease(gate, frame);
+        this.applyRelease(gate.key, deltas, undefined, newlyHydrated);
+        // I-iv phase 2: a retargeted sub whose first ROOM snapshot released just now gets its old
+        // channel's rows GC'd — AFTER the release fully applied, so the winner flip is value-equal
+        // against the freshly-folded room rows (never a remove-before-the-refill).
+        this.flushRetargetGc(gate);
+        // I-iv doorbell events LAST — everything this release carried (data, confirms, the occupancy
+        // fold itself, the retarget cutover) is already applied when the consumer's reaction (an
+        // async re-lease) is kicked off. One event per touched scope, count evaluated at the fold
+        // clock's now (deterministic under an injected clock).
+        if (touchedScopes !== null) {
+            for (const scope of touchedScopes) {
+                this.scopeSessionsHandler({ scope, others: this.otherScopeSessions(scope) });
+            }
+        }
+    }
+    /** Compute one coherent release from ONE gate's cv-buffer (§5.1) — gate-scoped: its buffer, its
+     *  cvMin timeline. Take every buffered frame at `cv ≤ cvMin`, in (cv, arrival) order, and fold
+     *  it: the lmid system-query frame advances `watermark[gate.key]` (via {@link foldLmidOps} — the
+     *  daemon stream folds "daemon", a room stream folds its own domain); data frames fold through
+     *  this SOURCE's cross-query refcount into ONE net base delta — the §1.3 `D`. Returns that delta
+     *  plus the set of local views this release JUST hydrated (so their reconcile batch phases as a
+     *  `snapshot`). Mutates the gate's buffer/`appliedCv`, hydration, and the gate's domain
+     *  watermark; the pending set and the reconcile are {@link applyRelease}'s job. */
+    computeRelease(gate, frame) {
+        // Snapshot which local views are already hydrated BEFORE this release folds: any that cross into
+        // hydrated below get their first result set as this cycle's batch, which must phase as a snapshot.
+        const wasHydrated = new Set(this.hydrated);
+        const ready = gate.buffer
             .filter((f) => f.cv <= frame.cvMin)
             .sort((a, b) => a.cv - b.cv || a.seq - b.seq);
-        this.buffer = this.buffer.filter((f) => f.cv > frame.cvMin);
+        gate.buffer = gate.buffer.filter((f) => f.cv > frame.cvMin);
+        // The §4 lifecycle SYSTEM frames fold FIRST, in a FIXED structural category order (Slice
+        // I-iii; see {@link foldSystemFrames} for why the order is load-bearing), then the ordinary
+        // lmid + data frames fold exactly as before. With no system retain the partition is empty and
+        // this release is byte-identical to pre-I-iii. The returned scope set feeds the I-iv doorbell
+        // events `onGateProgress` fires once the WHOLE release has applied.
+        const touchedScopes = this.foldSystemFrames(ready.filter((f) => this.systemQids.has(f.qid)));
         const muts = [];
         for (const f of ready) {
+            if (this.systemQids.has(f.qid)) {
+                // Folded above; a system stream has no store view and MUST NOT enter the sync layer (its
+                // tables are not in the schema) — but its first snapshot still marks the sub hydrated so
+                // the overflow/introspection bookkeeping stays uniform.
+                if (f.kind === "snapshot")
+                    this.markSubHydrated(f.qid);
+                continue;
+            }
             if (f.qid === LMID_QID) {
-                this.foldLmidOps(f.ops);
+                // Confirmation and data of the same commit share a cv, so they release together — each
+                // channel's lmid stream folds into ITS OWN domain's watermark (§7.1).
+                this.foldLmidOps(f.ops, gate.key);
                 continue;
             }
-            muts.push(...(f.kind === "snapshot" ? this.sync.rehydrate(f.qid, f.ops) : this.sync.applyBatch(f.qid, f.ops)));
+            muts.push(...(f.kind === "snapshot" ? gate.sync.rehydrate(f.qid, f.ops) : gate.sync.applyBatch(f.qid, f.ops)));
             // A query's first released snapshot is its hydration point — even an empty one (0 rows is an
             // authoritative answer): lift every local view this sub feeds out of `unknown` (loading).
             if (f.kind === "snapshot")
                 this.markSubHydrated(f.qid);
         }
-        this.appliedCv = Math.max(this.appliedCv, frame.cvMin);
-        // (2) Drop confirmed pending (§1.3 step 5's bookkeeping half): mid ≤ the lmid this
-        // release itself delivered. A failed mutation drops the same way — the release just
-        // carries no effects for it, so the rewind in (3) snaps the prediction back. An UNFLUSHED
-        // folded entry (`mid == null`) is never confirmable — it has not crossed the wire — so it is
-        // always retained until its own flush stamps a real mid (FOLDED-MUTATIONS-DESIGN §4.1).
+        gate.appliedCv = Math.max(gate.appliedCv, frame.cvMin);
+        let newlyHydrated = null;
+        for (const qid of this.hydrated) {
+            if (!wasHydrated.has(qid))
+                (newlyHydrated ??= new Set()).add(qid);
+        }
+        return { deltas: muts, newlyHydrated, touchedScopes };
+    }
+    /** Apply one released delta against `sourceKey`'s domain (§7.2 per-domain confirm-drop + the §1.3
+     *  reconcile cycle). `watermarkUpdate`, when given, advances `watermark[sourceKey]` first — the
+     *  hook a per-source lmid confirm rides on (the daemon path folds its watermark in
+     *  {@link computeRelease} and passes `undefined`). Then: drop every pending entry its OWN domain's
+     *  watermark now covers (a room confirm can never retire a daemon entry, and vice-versa — the §7.1
+     *  ledger-collision fix), and run the reconcile cycle against `sourceKey` when the base delta or the
+     *  pending set changed. `newlyHydrated` stamps the initial-hydration batch as a catch-up. */
+    applyRelease(sourceKey, deltas, watermarkUpdate, newlyHydrated = null) {
+        if (watermarkUpdate !== undefined) {
+            this.watermark.set(sourceKey, Math.max(this.watermark.get(sourceKey) ?? 0, watermarkUpdate));
+        }
+        // Echo hold-back (§7.3), BEFORE the confirm-drop: an entry `p` this release CONFIRMS
+        // (`p.mid <= watermark[p.domain]`) but which staged a write onto a DIFFERENT source `S` (a
+        // cross-slice write — e.g. a room-domain mutation whose write routed to the daemon slice) is
+        // about to leave `pendingMutations`, so it will NOT be re-invoked on `S`'s next rewind. Park each
+        // such write inertly on `S` so that rewind (which un-applies the not-re-invoked write) does not
+        // flash-revert it. Two variants, one per write shape (G-i unified them engine-side):
+        //   - ADD/EDIT (`rec.row` present): pinned PRESENCE — drops when `S`'s confirmed baseline
+        //     value-matches (its echo lands — the E-i-tested drop).
+        //   - REMOVE (`rec.row === undefined`, G-iii): pinned ABSENCE — the §7.3 tombstone, parked with
+        //     the captured pre-image (`rec.oldRow`) so `S`'s rewind cannot resurrect the deleted row;
+        //     drops when `S`'s baseline lacks the pk (the delete echoed).
+        // Inert in single-domain: every write's source equals its domain.
+        for (const p of this.pendingMutations) {
+            if (p.mid === null || p.mid > (this.watermark.get(p.domain) ?? 0))
+                continue; // not confirmed now
+            for (const [table, byPk] of p.writes) {
+                // The Collapsed-park gate (G-iii): NEVER park on an un-promoted table. Inert-anyway today
+                // (`rewind_collapsed` never consults `held_back`), so skipping is behaviorally identical —
+                // but a stale Collapsed-era entry would become overlay-first-visible (a permanent pin) if
+                // the table later promotes. Slice H's prove-or-slow-path routing makes the real scenario
+                // (a room-confirmed mutation writing a Collapsed table) impossible; this covers until then.
+                if (!this.promotedTables.has(table))
+                    continue;
+                for (const [pkKey, rec] of byPk) {
+                    const s = p.writeSources.get(writeSourceKey(table, pkKey));
+                    if (s === undefined || s === p.domain)
+                        continue; // same-slice: the rewind replays it
+                    if (rec.row !== undefined)
+                        this.local.holdBack(table, s, rec.row);
+                    else if (rec.oldRow !== undefined)
+                        this.local.holdBackAbsent(table, s, rec.oldRow);
+                    else
+                        continue;
+                    // §301 §2.1: register the pin's delivery-fence inputs in the same breath as the park.
+                    this.registerPin(table, s, pkKey, rec.row ?? rec.oldRow, p);
+                }
+            }
+        }
+        // Drop confirmed pending (§1.3 step 5's bookkeeping half), PER DOMAIN: an entry is retired only
+        // when ITS domain's watermark reaches its mid — so two concurrent streams never alias one counter
+        // (§7.1). A failed mutation drops the same way (the release carries no effects, so the rewind snaps
+        // the prediction back). An UNFLUSHED fold (`mid == null`) is never confirmable — retained until its
+        // flush stamps a real mid (FOLDED-MUTATIONS-DESIGN §4.1), regardless of any domain's watermark.
+        // H-v NOTE — retiring here treats coverage as SUCCESS, which for a room domain is sound only
+        // because outcome resolution ALWAYS precedes the coverage that retires: on the room socket
+        // the outcome frames outrun the lmid acks (same-socket ordering + the resync re-send), and on
+        // the daemon-carried path (I-iii) `foldSystemFrames` routes the co-committed outcome ROWS
+        // through handleMutationOutcome BEFORE the ledger fold advances the watermark this filter
+        // reads — a deopted entry has already flipped off the domain by the time its burnt mid is
+        // covered, either way (the named invariant above handleMutationOutcome).
         const before = this.pendingMutations.length;
-        this.pendingMutations = this.pendingMutations.filter((p) => p.mid === null || p.mid > this.confirmedLmid);
+        this.pendingMutations = this.pendingMutations.filter((p) => p.mid === null || p.mid > (this.watermark.get(p.domain) ?? 0));
         const pendingChanged = this.pendingMutations.length !== before;
-        // (3) The reconcile cycle — only when something can have changed: a base delta to
-        // fold in, or a pending set that shrank (its optimistic layer must rewind out).
-        if (muts.length || pendingChanged) {
-            this.runReconcileCycle(muts);
+        // The reconcile cycle — only when something can have changed: a base delta to fold in, or a
+        // pending set that shrank (its optimistic layer must rewind out). The batch it emits for any view
+        // that JUST became hydrated is that view's initial result set, so mark those qids so the
+        // local-event forwarder stamps their batch `catchUp` (→ Store phases it `snapshot`).
+        if (deltas.length || pendingChanged) {
+            const emitted = (this.catchUpEmitted = new Set());
+            this.catchUpQids = newlyHydrated;
+            try {
+                this.runReconcileCycle(sourceKey, deltas);
+            }
+            finally {
+                this.catchUpQids = null;
+                this.catchUpEmitted = null;
+            }
+            // Drop the qids the reconcile actually delivered a batch for; the rest folded nothing.
+            if (newlyHydrated)
+                for (const qid of emitted)
+                    newlyHydrated.delete(qid);
         }
-        // (4) ResultType is the SERVER CHANNEL's state only now (§7): `unknown` while not hydrated,
-        // else `complete` — a pending mutation no longer moves it. The pending axis moves separately.
+        // ResultType is the SERVER CHANNEL's state only now (§7): `unknown` while not hydrated, else
+        // `complete` — a pending mutation no longer moves it. The pending axis moves separately.
         for (const qid of this.queryTables.keys()) {
             this.setResultType(qid, this.hydrated.has(qid) ? "complete" : "unknown");
         }
+        // A newly-hydrated query whose reconcile emitted NO batch (0 rows, its whole result already present
+        // via a sibling → 0 net muts, or the reconcile was skipped) still needs a hydration signal, or its
+        // SSR seed never retires and the view freezes. Send an explicit empty catch-up (now that it reads
+        // `complete`, the Store retires the seed and reveals whatever is already in its tree).
+        if (newlyHydrated) {
+            for (const qid of newlyHydrated)
+                this.handler(qid, { type: "batch", events: [], catchUp: true });
+        }
         this.refreshPending();
+        // The §301 echo-fence drop pass — strictly AFTER the reconcile above folded this release's
+        // data, so a fence that cleared in this release drops its pin only once the co-committed
+        // echo data is actually in the baseline (dropping earlier would itself reopen the flash
+        // window §7.3 closes). Structural no-op with no pins (every single-domain client).
+        this.dropEchoFencePins();
+        // The I-v ghost-drop watcher (§4.2), LAST: this release's watermark rows have folded
+        // (computeRelease) and its confirm-drop has retired what it covers — exactly the two inputs
+        // the drop condition reads. Structural no-op with no ghost.
+        this.evaluateGhosts();
+    }
+    /** Test-only per-source release seam (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.2/§8.5): drive
+     *  {@link applyRelease} for `sourceKey` directly — an explicit `watermarkUpdate` (a simulated lmid
+     *  confirm for that domain) and `deltas` (a coherent base delta), with no real gate. Lets a harness
+     *  exercise a room-domain confirm before the real second lmid stream / per-source gate is wired
+     *  (E-iii-b/c). The `__`-prefix marks it a test hook, alongside {@link __inspect}. */
+    __testRelease(sourceKey, deltas, watermarkUpdate) {
+        this.applyRelease(sourceKey, deltas, watermarkUpdate);
+    }
+    // --- the §301 echo fences (301-ECHO-FENCE-DESIGN.md) -----------------------------------
+    /** Register (or overwrite — a later cross-slice confirm re-pinning the same slice-pk matches
+     *  the engine's `held_back.insert`) one {@link EchoFencePin}, in the same breath as the
+     *  engine park (§2.1). `p` is the confirmed entry whose write staged onto `sourceKey`; its
+     *  `mid` is non-null by the caller's confirm filter. */
+    registerPin(table, sourceKey, pkKey, probeRow, p) {
+        const pin = {
+            table,
+            sourceKey,
+            probeRow,
+            domain: p.domain,
+            mid: p.mid,
+        };
+        if (sourceKey !== "daemon" && p.domain === "daemon") {
+            // Direction B stamps (§1.2): the parking daemon release's coherence position — the confirm
+            // folded at-or-before it, so a room advertising absorption ≥ this cv has absorbed the
+            // commit that carried the write — plus the client-observed boot it belongs to (§2.4).
+            pin.daemonCv = this.daemonGate.appliedCv;
+            if (this.daemonBootId !== undefined)
+                pin.daemonBoot = this.daemonBootId;
+        }
+        // The tripwire reference (§2.5): the slice's confirmed-baseline row at park.
+        pin.baselineAtPark = this.local.heldBackState(table, sourceKey, probeRow)?.baseline;
+        this.pins.set(`${table}\0${sourceKey}\0${pkKey}`, pin);
+    }
+    /** The §2.3 drop pass, run at the tail of every applied release: prune registry entries whose
+     *  engine pin is already gone (the rewind's state-match fallback or a whole-source removal beat
+     *  the fence — benign), drop every pin whose fence cleared (one engine drop each, delivered on
+     *  the ordinary event stream, bracketed as ONE notification commit), and tripwire the rest. */
+    dropEchoFencePins() {
+        if (this.pins.size === 0)
+            return; // every single-domain client: structural no-op
+        let cleared = null;
+        for (const [key, pin] of this.pins) {
+            const state = this.local.heldBackState(pin.table, pin.sourceKey, pin.probeRow);
+            if (state === undefined) {
+                this.pins.delete(key); // engine pin gone (state-match / source removal): lazy prune
+                continue;
+            }
+            if (this.pinFenceCleared(pin))
+                (cleared ??= []).push([key, pin]);
+            else
+                this.maybeTripwirePin(key, pin, state.baseline);
+        }
+        if (!cleared)
+            return;
+        this.inOneCommit(() => {
+            for (const [key, pin] of cleared) {
+                this.pins.delete(key);
+                this.local.dropHeldBack(pin.table, pin.sourceKey, pin.probeRow);
+            }
+        });
+    }
+    /** Has `pin`'s delivery fence provably closed its confirm→echo window? (§2.3/§2.4.) */
+    pinFenceCleared(pin) {
+        if (pin.sourceKey === "daemon") {
+            // Direction A: the daemon-carried ledger for the confirming room domain covers the mid —
+            // the I-ii co-commit means this release (or an earlier one) folded the flush data that
+            // carried it into the daemon baseline (§1.1).
+            return (this.daemonCarriedLmid.get(pin.domain) ?? 0) >= pin.mid;
+        }
+        // Direction B: only a daemon-confirmed write has the daemon-cv stamp; a room-staged pin
+        // confirmed by ANOTHER room (outside today's two-tier topology) has no fence.
+        if (pin.daemonCv === undefined)
+            return false;
+        const gate = this.gates.get(pin.sourceKey);
+        if (!gate || gate.upstreamCv === undefined)
+            return false; // no advert (old shell): §2.5 fallback
+        if (gate.upstreamBoot === pin.daemonBoot)
+            return gate.upstreamCv >= pin.daemonCv;
+        // Boot mismatch (§2.4): a boot the client has OBSERVED as later proves absorption (the
+        // room's post-restart re-snapshot came from daemon state that durably includes the
+        // confirmed write); an unknown/older/unstamped boot holds — conservative, its next
+        // re-snapshot advances it.
+        if (pin.daemonBoot === undefined || gate.upstreamBoot === undefined)
+            return false;
+        const pinOrd = this.daemonBootOrdinals.get(pin.daemonBoot);
+        const advOrd = this.daemonBootOrdinals.get(gate.upstreamBoot);
+        return pinOrd !== undefined && advOrd !== undefined && advOrd > pinOrd;
     }
-    /** Fold the lmid system query's released ops (lmid-as-data): the one row's
-     *  `last_mutation_id` cell is this client's confirmed high-water mid. */
-    foldLmidOps(ops) {
+    /** The §2.5 stuck-pin tripwire, in the scopesHash spirit: log ONCE per pin when its slice's
+     *  baseline row has CHANGED VALUE since park while the pin still holds — the suspicious state
+     *  that precedes every forever-pin (a fence-less pairing, a fence bug). Never drops anything. */
+    maybeTripwirePin(key, pin, baseline) {
+        if (pin.tripwired)
+            return;
+        const same = pin.baselineAtPark === undefined || baseline === undefined
+            ? pin.baselineAtPark === baseline
+            : pin.baselineAtPark.length === baseline.length &&
+                pin.baselineAtPark.every((c, i) => identicalCell(c, baseline[i]));
+        if (same)
+            return;
+        pin.tripwired = true;
+        const [table, sourceKey, pkKey] = key.split("\0");
+        console.warn(`rindle: a §7.3 hold-back pin on table "${table}" slice "${sourceKey}" pk ${pkKey} (confirming domain ${pin.domain}, mid ${pin.mid}) is parked while its slice's baseline moved past it — if this client never converges on that row, this pin is why (301-ECHO-FENCE-DESIGN.md §2.5).`);
+    }
+    /** Record one observed daemon boot id (§2.4): first observation of an id assigns the next
+     *  ordinal (the client's own total order over opaque boot ids); every call refreshes the
+     *  current-boot stamp for direction-B parks. */
+    observeDaemonBoot(bootId) {
+        if (!this.daemonBootOrdinals.has(bootId)) {
+            this.daemonBootOrdinals.set(bootId, this.daemonBootOrdinals.size);
+        }
+        this.daemonBootId = bootId;
+    }
+    /** Promote `table` to a MERGED multi-source engine with room `sourceKey`'s per-row writable
+     *  scope (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §5.2) — THE one promotion seam. The engine
+     *  attach and the {@link promotedTables} record move in the same breath: the §7.3 hold-back
+     *  trigger in {@link applyRelease} parks ONLY on promoted tables, so a promotion that bypassed
+     *  the record would silently disable the echo hold-back for that table (and a record without the
+     *  engine attach would park onto a slice that doesn't exist). Recorded AFTER the engine accepts —
+     *  a rejected descriptor/table must not leave a phantom promotion. Slice G-v's client drives this
+     *  from the lease's `realtime.tables` (`RoomTableSpec` → {@link WritableDescriptor}); idempotence
+     *  per `(sourceKey, table)` is the CALLER's job (the engine refuses a duplicate room).
+     *
+     *  `spec` (H-iii) is the per-table ROUTING spec riding the same lease table block — recorded
+     *  into {@link roomRouting} (THE routing table the §3 router reads) in the same breath, with
+     *  `writable` derived from the descriptor's kind (`none` = a context table the room may not
+     *  write). Omitted (the E-iii-b harness alias below) ⇒ an empty spec: no join keys to guard, no
+     *  `footprintWhere` (that room's reads then fail closed to the daemon unless self/room-served). */
+    promoteRoomTable(table, sourceKey, writable, spec) {
+        this.local.addRoomSource(table, sourceKey, writable);
+        this.promotedTables.add(table);
+        let byTable = this.roomRouting.get(sourceKey);
+        if (!byTable)
+            this.roomRouting.set(sourceKey, (byTable = new Map()));
+        byTable.set(table, {
+            writable: writable.kind !== "none",
+            joinKeyCols: [...(spec?.joinKeyCols ?? [])],
+            ...(spec?.where !== undefined ? { where: spec.where } : {}),
+            ...(spec?.footprintWhere !== undefined ? { footprintWhere: spec.footprintWhere } : {}),
+        });
+    }
+    /** The recorded routing specs for `sourceKey`'s promoted tables (table → its
+     *  {@link RoomTableRouting}) — read-only: the client's `__realtimeInspect`/idempotence
+     *  bookkeeping reads THIS record instead of keeping its own shadow copy (one source of truth).
+     *  Empty map when the room has promoted nothing. */
+    roomTablesFor(sourceKey) {
+        return this.roomRouting.get(sourceKey) ?? EMPTY_ROUTING;
+    }
+    /** Test-named alias of {@link promoteRoomTable} (E-iii-b scaffolding — the multi-domain oracle
+     *  and per-source-gate suites drive it). Pure delegation: ONE body, one `promotedTables` record. */
+    __addRoomSource(table, roomKey, writable, spec) {
+        this.promoteRoomTable(table, roomKey, writable, spec);
+    }
+    /** Fold `domain`'s lmid system query's released ops (lmid-as-data): the one row's
+     *  `last_mutation_id` cell is this client's confirmed high-water mid in that domain — it advances
+     *  `watermark[domain]` and, on a fresh session ahead of our issued mids, `nextMid[domain]`. The
+     *  daemon stream folds `"daemon"`; a room stream folds its own `"room:doc:X"`; the daemon-carried
+     *  §7.1 ledger rows fold through the same {@link foldConfirm} core (Slice I-iii). */
+    foldLmidOps(ops, domain) {
         for (const op of ops) {
             const row = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
             if (!row)
                 continue; // a remove (client GC) confirms nothing
-            const lmid = Number(row[1]);
-            if (!Number.isFinite(lmid))
-                continue;
-            if (lmid > this.nextMid - 1) {
-                if (this.pendingMutations.length > 0) {
-                    // The server confirmed a mid we never issued while we have mutations in
-                    // flight — two writers on one clientID or corrupted state. Unrecoverable.
-                    throw new Error(`optimistic backend: confirmed lmid ${lmid} is ahead of issued mids (${this.nextMid - 1})`);
+            this.foldConfirm(domain, Number(row[1]));
+        }
+    }
+    /** THE one confirm fold (§7.1/§7.2): advance `watermark[domain]` to `lmid` (monotone max) and,
+     *  on a fresh session ahead of our issued mids, adopt `nextMid[domain]`. Shared verbatim by the
+     *  per-channel lmid system query ({@link foldLmidOps}) and the daemon-carried room-ledger rows
+     *  ({@link foldSystemFrames} — one core so the two paths cannot drift). */
+    foldConfirm(domain, lmid) {
+        if (!Number.isFinite(lmid))
+            return;
+        const highestIssued = (this.nextMid.get(domain) ?? 1) - 1;
+        if (lmid > highestIssued) {
+            // Only in-flight mutations of THIS domain can contradict its watermark (§7.1: the counters
+            // are independent — a room-domain mutation pending while the daemon's historical lmid
+            // snapshot arrives is a normal fresh-session interleaving, not a second writer). An
+            // unflushed fold (`mid == null`) has issued nothing yet either way: it cannot explain a
+            // confirmed-ahead lmid, and its eventual flush deals from the adopted counter below.
+            if (this.pendingMutations.some((p) => p.domain === domain && p.mid !== null)) {
+                // The server confirmed a mid we never issued while we have mutations in
+                // flight on this domain — two writers on one clientID or corrupted state. Unrecoverable.
+                throw new Error(`optimistic backend: confirmed lmid ${lmid} is ahead of issued mids (${highestIssued})`);
+            }
+            // A fresh session over a clientID with history: adopt the server's high-water
+            // mark so our next mid continues the sequence instead of colliding below it.
+            this.nextMid.set(domain, lmid + 1);
+        }
+        this.watermark.set(domain, Math.max(this.watermark.get(domain) ?? 0, lmid));
+    }
+    // --- the §4 lifecycle system-stream folds (Slice I-iii) --------------------------------
+    /** Fold one release's SYSTEM frames in a FIXED category order — the order is STRUCTURAL (one
+     *  function, categories in sequence), because it is the client half of THE NAMED INVARIANT
+     *  (§3.3's shipped note; documented above {@link handleMutationOutcome}): **never retire a
+     *  room-domain entry off a daemon-carried lmid without outcome resolution.**
+     *
+     *    1. **outcome rows** (`_rindle_room_mutation_outcomes`) — each row for OUR clientID is
+     *       synthesized into a {@link MutationOutcomeFrame} and routed through
+     *       {@link handleMutationOutcome}, the SAME H-v state machine the room socket's frames use
+     *       (one verdict path: frames and rows cannot drift). A deopt flips its pending entry to
+     *       the daemon IN PLACE (keep-seq, deal-and-send-now); a rejection surfaces + stays for the
+     *       ordinary burnt-mid retire; a duplicate (frame already seen, or the row re-delivered) is
+     *       absorbed by the processed set — which doubles as the resolved-verdict memory across
+     *       releases (per-domain FIFO, {@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}, mirroring the
+     *       shell's recorded-outcome cap).
+     *    2. **room-ledger rows** (`_rindle_room_client_mutations`) — the FIRST daemon-carried
+     *       room-lmid path: OUR row's `last_mutation_id` folds into `watermark[room:<doc>]` via
+     *       {@link foldConfirm}. Because step 1 ALREADY resolved every non-applied verdict this
+     *       release carries (and earlier releases' verdicts were resolved at their own release),
+     *       the confirm-drop that follows in {@link applyRelease} retires only entries whose
+     *       outcome is resolution-by-absence — which I-ii's co-commit atomicity defines as APPLIED
+     *       (a room flush co-commits the ledger row and every non-applied mid's outcome row in ONE
+     *       daemon transaction, so a covering lmid without a row IS the applied verdict).
+     *       Processing this category before step 1 is the violation, in two proven directions
+     *       (each run break→fail→revert against `test/system_streams.test.ts`): (a) the ledger's
+     *       fresh-session `nextMid` ADOPTION must not run before historical outcome rows are
+     *       judged — adopted-first, a previous session's retained deopt row passes the
+     *       "never-issued" guard and spuriously re-invokes a mutation that session already handled
+     *       (a double-apply); (b) the RETIRE must not precede resolution — it does not BECAUSE the
+     *       confirm-drop runs in {@link applyRelease}, strictly after this whole function. That
+     *       deferral is load-bearing: an "optimization" retiring inline with the watermark fold
+     *       retires a deopted entry as a silent success (the exact lost-write H-v exists to
+     *       prevent) and mis-attributes a rejected row's reason.
+     *    3. **watermark rows** (`_rindle_room_watermark`) — the §4.2 fence value, max-folded per
+     *       doc ({@link roomWatermarks}); I-v's ghost-drop consumer, no reaction here.
+     *    4. **scope-session rows** (`_rindle_scope_sessions`) — the §4.1 occupancy map
+     *       ({@link scopeSessions}); I-iv's doorbell consumer, no reaction here.
+     *
+     *  Ordinary data ops fold AFTER all of these (the caller's main loop) — outcome/ledger state
+     *  must be in place before {@link applyRelease}'s confirm-drop + reconcile consume the release.
+     *  Every row is filtered against the retain's {@link SystemStreamSpec} scope/doc AND (for the
+     *  client-keyed tables) our own `clientID` — defense in depth: the server predicate may have
+     *  been minted doc-only (no `clientId` at lease time), so other clients' rows are expected and
+     *  must be ignored, and a row for a doc this retain was not minted for is never folded.
+     *
+     *  Returns the scopes category 4 touched (snapshot or ops) — the I-iv doorbell events' input;
+     *  `null` when none (every non-lifecycle release). The events themselves fire from
+     *  `onGateProgress` AFTER the release applies, never from inside the fold. */
+    foldSystemFrames(frames) {
+        if (frames.length === 0)
+            return null;
+        const byTable = (table) => frames.flatMap((frame) => {
+            const spec = this.systemQids.get(frame.qid);
+            return spec !== undefined && spec.table === table ? [{ spec, frame }] : [];
+        });
+        // (1) outcome rows → the H-v machine, BEFORE any ledger fold (the named invariant).
+        for (const { spec, frame } of byTable(ROOM_MUTATION_OUTCOMES_TABLE)) {
+            for (const op of frame.ops) {
+                const cells = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
+                if (!cells)
+                    continue; // a remove is retention pruning (mid ≤ lmid − 512), never a verdict
+                const row = decodeOutcomeRow(cells);
+                if (!row || row.clientId !== this.clientID)
+                    continue;
+                if (spec.doc !== undefined && row.doc !== spec.doc)
+                    continue;
+                const frameShape = {
+                    mid: row.mid,
+                    kind: row.kind,
+                    ...(row.reason !== undefined ? { reason: row.reason } : {}),
+                    ...(row.name !== undefined ? { name: row.name } : {}),
+                    ...(row.args !== undefined ? { args: row.args } : {}),
+                };
+                // Release-time invocation is sound here where out-of-band was REQUIRED for the socket
+                // frames (`attachGate`): the socket frame races a buffered lmid ack it must beat, so it
+                // may not wait behind the gate — a ROW cannot race its own release (it and the covering
+                // ledger row co-committed at one cv and fold in THIS function's fixed order). The
+                // machine's steps need nothing from an open release: the flip/reject only move pending
+                // bookkeeping + ship an envelope, and the not-found re-invoke arm runs a fresh prediction
+                // — legal before `applyRelease` opens the reconcile cycle, identical to an app invoke
+                // racing the release.
+                this.handleMutationOutcome(roomDomainKey(row.doc), frameShape);
+            }
+        }
+        // (2) room-ledger rows → the daemon-carried per-domain confirm (outcomes above resolved first).
+        for (const { spec, frame } of byTable(ROOM_CLIENT_MUTATIONS_TABLE)) {
+            for (const op of frame.ops) {
+                const cells = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
+                if (!cells)
+                    continue; // a ledger remove confirms nothing (mirrors foldLmidOps)
+                const [doc, clientId, lmid] = cells;
+                if (typeof doc !== "string" || clientId !== this.clientID)
+                    continue;
+                if (spec.doc !== undefined && doc !== spec.doc)
+                    continue;
+                const covered = Number(lmid);
+                this.foldConfirm(roomDomainKey(doc), covered);
+                // The §301 direction-A fence input: the DAEMON-CARRIED ledger fold ALONE (the room
+                // socket's own lmid stream confirms long before the flush reaches the daemon, so it
+                // folds the shared watermark above but never this map — 301 §1.1). Max-fold: ledger
+                // rows re-deliver across re-hydrates.
+                if (Number.isFinite(covered)) {
+                    const dom = roomDomainKey(doc);
+                    this.daemonCarriedLmid.set(dom, Math.max(this.daemonCarriedLmid.get(dom) ?? 0, covered));
+                }
+            }
+        }
+        // (3) watermark rows → the monotone §4.2 fence value per doc.
+        for (const { spec, frame } of byTable(ROOM_WATERMARK_TABLE)) {
+            for (const op of frame.ops) {
+                const cells = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
+                if (!cells)
+                    continue; // the fence is monotone — a remove never regresses it
+                const [doc, flushSeq] = cells;
+                const seq = Number(flushSeq);
+                if (typeof doc !== "string" || !Number.isFinite(seq))
+                    continue;
+                if (spec.doc !== undefined && doc !== spec.doc)
+                    continue;
+                this.roomWatermarks.set(doc, Math.max(this.roomWatermarks.get(doc) ?? 0, seq));
+            }
+        }
+        // (4) scope-session rows → the §4.1 occupancy map (a snapshot REPLACES the scope's map — an
+        // authoritative re-hydrate must drop sessions that aged out while the stream was down; a
+        // batch folds add/edit/remove incrementally). Touched scopes are collected for the I-iv
+        // doorbell events (a snapshot touches its minted scope even with zero ops — an emptied-out
+        // scope is a legitimate 1→0 observation for the transition tracker).
+        let touchedScopes = null;
+        const touch = (scope) => {
+            (touchedScopes ??= new Set()).add(scope);
+        };
+        for (const { spec, frame } of byTable(SCOPE_SESSIONS_TABLE)) {
+            if (frame.kind === "snapshot" && spec.scope !== undefined) {
+                this.scopeSessions.set(spec.scope, new Map());
+                touch(spec.scope);
+            }
+            for (const op of frame.ops) {
+                // A remove's identity rides its (full) removed row; add/edit carry the post-image.
+                const cells = op.op === "edit" ? op.new : op.row;
+                const [scope, clientId, expiresAt] = cells;
+                if (typeof scope !== "string" || typeof clientId !== "string")
+                    continue;
+                if (spec.scope !== undefined && scope !== spec.scope)
+                    continue;
+                let sessions = this.scopeSessions.get(scope);
+                if (!sessions)
+                    this.scopeSessions.set(scope, (sessions = new Map()));
+                if (op.op === "remove") {
+                    sessions.delete(clientId);
                 }
-                // A fresh session over a clientID with history: adopt the server's high-water
-                // mark so our next mid continues the sequence instead of colliding below it.
-                this.nextMid = lmid + 1;
+                else {
+                    const exp = Number(expiresAt);
+                    if (Number.isFinite(exp))
+                        sessions.set(clientId, exp);
+                }
+                touch(scope);
             }
-            this.confirmedLmid = Math.max(this.confirmedLmid, lmid);
         }
+        return touchedScopes;
+    }
+    /** The I-iv occupancy count — THE one rule (§4.1/D7): unexpired (`expires_at >` the fold
+     *  clock's now) sessions under `scope` from OTHER clientIDs. Shared by the doorbell events
+     *  ({@link onGateProgress}) and the client's registration-time check (a doorbell that folded
+     *  BEFORE a candidate registered must still be able to trigger it) so the two can never
+     *  disagree. Own-clientID rows never count — a solo client cannot ring its own bell — and
+     *  expiry is judged on the injectable {@link FoldClock} (deterministic in a virtual-clock
+     *  harness, the folded-oracle discipline). */
+    otherScopeSessions(scope) {
+        const sessions = this.scopeSessions.get(scope);
+        if (!sessions)
+            return 0;
+        const now = this.clock.now();
+        let n = 0;
+        for (const [clientId, expiresAt] of sessions) {
+            if (clientId !== this.clientID && expiresAt > now)
+                n++;
+        }
+        return n;
+    }
+    /** Register the I-iv doorbell event sink — see {@link ScopeSessionsEvent}. One handler (a later
+     *  registration replaces it, the {@link onLocalWrite} convention); client.ts is the consumer. */
+    onScopeSessions(handler) {
+        this.scopeSessionsHandler = handler;
     }
     /** One §1.3 reconcile cycle: rewind the optimistic layer and fold the coherent SERVER
      *  delta into BOTH head AND the `sync` baseline (`serverBatchBegin`), re-invoke every
@@ -767,37 +2327,61 @@ export class OptimisticBackend {
      *  deliver the coalesced result (`serverBatchEnd`). This is the engine's only sync-moving
      *  boundary — `onProgress` releases and `unregisterQuery`'s GC both go through here so head
      *  and sync never diverge (the §1.2 invariant; CRIT#2). */
-    runReconcileCycle(serverDeltas) {
-        this.local.serverBatchBegin(serverDeltas.map(toServerOp));
-        // The rewind cleared every optimistic write — incl. prior `__agg` edits — so head is now
-        // the server baseline. Rebuild the optimistic agg delta from scratch off the re-invoked
-        // (confirm-filtered) pending set, so a just-confirmed mutation's delta vanishes exactly as
-        // its server count is absorbed (§5 watermark — no double count).
-        this.overlay.reset();
-        // Re-invoke in WIRE order: assigned mids ascending, then unflushed folds (`mid == null`) last
-        // by creation order — the deterministic slot of FOLDED-MUTATIONS-DESIGN §4.1. A read-dependent
-        // mutator must replay against the same base the server computed from, which is mid order; with
-        // deferred fold mids, mid order ≠ creation order, so we sort rather than trust array order. The
-        // comparator is explicit (NOT `(mid ?? ∞) - (mid ?? ∞)`, which is `∞ - ∞ = NaN` for two unflushed
-        // folds — a NaN comparator silently corrupts V8's sort): assigned-before-unflushed, mids
-        // ascending, and STABLE for two unflushed folds so they keep creation order across cycles.
-        const order = [...this.pendingMutations].sort((a, b) => {
-            if (a.mid === null && b.mid === null)
+    runReconcileCycle(sourceKey, serverDeltas) {
+        // `sourceKey` names the authority these `deltas` confirm — `"daemon"` on the live daemon path (and
+        // the GC path), a `room:doc:X` string on a per-source release (E-iii). It selects which physical
+        // source the wasm engine's rewind folds the delta into (`Db::serverBatchBegin`). The E-iii-b/c
+        // per-source rewind + intersecting-pending re-invoke filter ride the same seam later.
+        this.local.serverBatchBegin(sourceKey, serverDeltas.map(toServerOp));
+        // The aggregate overlay (§4) is DAEMON-tracked: its `__agg_*` tables are server-authoritative
+        // synthetic tables that only the daemon feed drives. A room cycle must not wipe or rebuild it
+        // (that would double-count / lose daemon agg state), so gate every overlay interaction — reset,
+        // observe, and reconcileAggHead — on the daemon cycle. Single-domain: always daemon ⇒ unchanged.
+        const daemonCycle = sourceKey === "daemon";
+        if (daemonCycle) {
+            // The rewind cleared every optimistic write — incl. prior `__agg` edits — so head is now the
+            // server baseline. Rebuild the optimistic agg delta from scratch off the re-invoked
+            // (confirm-filtered) pending set, so a just-confirmed mutation's delta vanishes exactly as its
+            // server count is absorbed (§5 watermark — no double count).
+            this.overlay.reset();
+        }
+        // Sort ALL pending into SEND order (the client-global `seq` ascending, then unflushed folds
+        // last by creation order — the deterministic §4.1 slot; the comparator is explicit, NOT
+        // `(seq ?? ∞) - (seq ?? ∞)` which is `∞ - ∞ = NaN` and corrupts V8's sort), THEN FILTER to the
+        // writers of THIS source (§5.3): a per-source rewind un-applied ONLY that source's staged
+        // writes, so ONLY those must re-invoke — the others' predictions are intact on their un-rewound
+        // trees. The key MUST be `seq`, never `mid`: mids are per-domain (§7.1) so mids from different
+        // domains are incomparable — a mid-sort would replay a room mid 1 before a daemon mid 5 that
+        // was sent FIRST, letting a read-dependent mutator re-predict from a base it never saw
+        // (confirmation order is per-domain; replay order is client-global). FILTERING the
+        // globally-ordered array preserves the relative send order among the subset (the 200 §4.1
+        // invariant); NEVER re-sort the subset. Single-domain: every entry has
+        // `touchedSources = {"daemon"}` and seq order == mid order (except H-v deopt re-enqueues,
+        // which keep their ORIGINAL seq under a later daemon mid — deliberately, so this very sort
+        // replays them at their original overlay position) ⇒ byte-identical to before.
+        const order = [...this.pendingMutations]
+            .sort((a, b) => {
+            if (a.seq === null && b.seq === null)
                 return 0; // both unflushed → stable creation order
-            if (a.mid === null)
-                return 1; // an unflushed fold sorts after every assigned mid
-            if (b.mid === null)
+            if (a.seq === null)
+                return 1; // an unflushed fold sorts after every dealt seq
+            if (b.seq === null)
                 return -1;
-            return a.mid - b.mid;
-        });
+            return a.seq - b.seq;
+        })
+            .filter((p) => p.touchedSources.has(sourceKey));
         const dropped = new Set();
         try {
             for (const p of order) {
-                const touched = new Set();
+                // NO `readLog` here — recording is armed only on the initial `invoke` (§3.2 #2 note on
+                // `PendingMutation.reads`); a re-invocation's write-set still needs fresh capture (below).
+                const writes = new Map();
                 const ops = [];
+                const stagedKeys = [];
+                let sources = [];
                 try {
-                    this.local.writeWith((tx) => {
-                        this.runMutator(this.registry[p.name], trackingTx(tx, touched, this.specs, this.localTables, this.opCollector(ops)), p.args);
+                    sources = this.local.writeWith((tx) => {
+                        this.runMutator(this.registry[p.name], trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, undefined, stagedKeys), p.args);
                     });
                 }
                 catch {
@@ -810,52 +2394,71 @@ export class OptimisticBackend {
                     dropped.add(p);
                     continue;
                 }
-                // The re-invocation stuck — fold its child ops into the rebuilt optimistic agg delta.
-                for (const op of ops)
-                    this.overlay.observe(op);
+                // The re-invocation stuck — fold its child ops into the rebuilt optimistic agg delta (daemon
+                // cycle only — a room cycle leaves the daemon-tracked overlay untouched).
+                if (daemonCycle)
+                    for (const op of ops)
+                        this.overlay.observe(op);
                 // The pending footprint is the UNION across invocations: a re-run that no-ops (touched =
                 // {}) must NOT shrink it, else a still-pending mutation reports not-pending and its
-                // pending-axis clear fires early (§7.2).
-                for (const t of touched)
+                // pending-axis clear fires early (§7.2). `writes`/the source axes mirror this: merge, never
+                // replace. (A re-invocation may route differently, e.g. onto a source the room feed now
+                // holds — union so the filter still catches it on either source's next cycle.)
+                for (const t of writes.keys())
                     p.touched.add(t);
+                mergeWriteSet(p.writes, writes);
+                for (const s of sources)
+                    p.touchedSources.add(s);
+                mergeWriteSources(p.writeSources, stagedKeys, sources);
             }
             // Preserve creation order in the live array (the unflushed-fold sort tiebreak depends on it).
             if (dropped.size)
                 this.pendingMutations = this.pendingMutations.filter((p) => !dropped.has(p));
             // Re-apply the optimistic agg delta onto the (rewound) `__agg` head rows — INSIDE the open
             // cycle, so the writes buffer and coalesce into the one per-query delivery `serverBatchEnd`
-            // makes (and never escape as a separate batch).
-            this.reconcileAggHead();
+            // makes (and never escape as a separate batch). Daemon cycle only (see above).
+            if (daemonCycle)
+                this.reconcileAggHead();
         }
         finally {
             this.local.serverBatchEnd(); // ALWAYS close the cycle — ONE delivery per affected query.
         }
     }
-    /** The daemon restarted (a new boot id): it lost all materialization + `cv` state and its `cv`
-     *  sequence reset, so previously-released `cv`s no longer bound the new stream. The source has
-     *  already re-subscribed every query (reconnect → resync); drop the buffer and the `cv`
-     *  watermark so the fresh, low-`cv` snapshots are RELEASED instead of dropped as stale
-     *  (`onNormalized`/`onProgress` gate on `appliedCv`). Pending optimistic mutations stay put —
-     *  they re-apply on the next reconcile, and the lmid system query's fresh snapshot restores the
-     *  confirmation watermark. */
-    resetForRestart() {
-        this.buffer = [];
-        this.appliedCv = 0;
-    }
-    /** The §8.5 escape: the buffer outgrew its cap (a pinned `cvMin` under churn). Drop
-     *  everything buffered and re-register every query on the source — the fresh
-     *  snapshots arrive as ordinary frames and the next release re-hydrates via the
-     *  footprint diff (the §5.3 path); still-pending optimism re-applies in that cycle. */
-    overflow() {
-        this.buffer = [];
+    /** ONE channel's authority restarted (a new boot id): it lost all materialization + `cv` state
+     *  and its `cv` sequence reset, so previously-released `cv`s no longer bound the new stream. The
+     *  source has already re-subscribed every query (reconnect → resync); drop THIS gate's buffer
+     *  and `cv` watermark so the fresh, low-`cv` snapshots are RELEASED instead of dropped as stale
+     *  (`onFrame`/`computeRelease` gate on `appliedCv`). The OTHER gates are untouched — an
+     *  authority restart is per-channel (§5.1). Pending optimistic mutations stay put — they
+     *  re-apply on the next reconcile, and the channel's lmid system query's fresh snapshot restores
+     *  its domain's confirmation watermark. */
+    resetGate(gate) {
+        gate.buffer = [];
+        gate.appliedCv = 0;
+        // The §301 upstream-absorption advert dies with the incarnation that made it — the fresh
+        // one re-advertises (direction-B pins conservatively hold until it does).
+        delete gate.upstreamBoot;
+        delete gate.upstreamCv;
+    }
+    /** The §8.5 escape: ONE gate's buffer outgrew its cap (a pinned `cvMin` under churn on that
+     *  channel). Drop everything it buffered and re-register every query on that source — the fresh
+     *  snapshots arrive as ordinary frames and the next release re-hydrates via the footprint diff
+     *  (the §5.3 path); still-pending optimism re-applies in that cycle. The other gates' buffers
+     *  and subscriptions are untouched. */
+    overflow(gate) {
+        gate.buffer = [];
         for (const sub of this.remoteSubs.values()) {
-            this.source.unregisterQuery(sub.sourceQid);
-            this.source.registerQuery(sub.sourceQid, sub.remote);
+            // Re-register only the subs THIS channel owns ({@link RemoteSub.channel} — the one source
+            // of truth, G-iii): resubscribing another channel's sub here would fork its stream.
+            if (sub.channel !== gate.key)
+                continue;
+            gate.source.unregisterQuery(sub.sourceQid);
+            gate.source.registerQuery(sub.sourceQid, sub.remote);
         }
         // The lmid system query's buffered frames were dropped too — re-subscribe it so a
         // fresh snapshot restores the confirmation watermark.
-        this.source.unregisterQuery(LMID_QID);
-        this.source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
+        gate.source.unregisterQuery(LMID_QID);
+        gate.source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
     }
     setResultType(qid, rt) {
         if (this.resultTypes.get(qid) === rt)
@@ -884,16 +2487,25 @@ export class OptimisticBackend {
             this.recomputeResultType(localQid);
         }
     }
-    retainRemote(retainQid, remote, localQueryId = retainQid) {
+    /** `channel` (G-iii registration-time routing): the gate the sub registers on — the qid's
+     *  ownership is fixed HERE, at retain time (no lazy claim; `onFrame` only asserts it). Default
+     *  `"daemon"`, so every channel-less caller is byte-identical to before. */
+    retainRemote(retainQid, remote, localQueryId = retainQid, channel = "daemon") {
+        const gate = this.requireGate(channel); // throw loudly BEFORE any sub state moves
         const key = remoteKey(remote);
         let sub = this.remoteSubs.get(key);
         let isNew = false;
         if (!sub) {
-            sub = { sourceQid: retainQid, remote, refCount: 0, localQids: new Map(), hydrated: false };
+            sub = { sourceQid: retainQid, remote, refCount: 0, localQids: new Map(), hydrated: false, channel };
             this.remoteSubs.set(key, sub);
             this.sourceToRemote.set(sub.sourceQid, key);
             isNew = true;
         }
+        else if (sub.channel !== channel) {
+            // A (name,args) sub lives on ONE channel — a second retain naming another is a wiring bug
+            // (it would split the query's frames across two cv timelines). Fail loudly.
+            throw new Error(`optimistic backend: query "${remote.name}" is already retained on channel ${JSON.stringify(sub.channel)} — cannot retain it on ${JSON.stringify(channel)}`);
+        }
         sub.refCount++;
         if (localQueryId !== undefined) {
             sub.localQids.set(localQueryId, (sub.localQids.get(localQueryId) ?? 0) + 1);
@@ -908,8 +2520,10 @@ export class OptimisticBackend {
         }
         this.localToRemote.set(retainQid, key);
         this.remoteRetainToLocal.set(retainQid, localQueryId);
+        // Register on the CHANNEL's source (G-iii): the qid's frames will arrive — and buffer, release,
+        // and overflow — on that channel's own §5.1 gate.
         if (isNew)
-            this.source.registerQuery(sub.sourceQid, remote);
+            gate.source.registerQuery(sub.sourceQid, remote);
     }
     releaseRemote(retainQid) {
         const key = this.localToRemote.get(retainQid);
@@ -931,7 +2545,10 @@ export class OptimisticBackend {
         }
         if (sub.refCount > 0)
             return undefined;
-        this.source.unregisterQuery(sub.sourceQid);
+        // Unregister from the SAME gate's source the retain registered on. Since I-v a gate CAN be
+        // removed ({@link disconnectSource}) — but never with a live sub on it ({@link
+        // demoteRoomSource} validates loudly), so the daemon fallback is purely defensive.
+        (this.gates.get(sub.channel) ?? this.daemonGate).source.unregisterQuery(sub.sourceQid);
         this.sourceToRemote.delete(sub.sourceQid);
         this.remoteSubs.delete(key);
         return sub.sourceQid;
@@ -1009,18 +2626,146 @@ function colIndexFromSchema(schema) {
     }
     return out;
 }
-/** Wrap the raw wasm txn as the client `MutationTx`, recording the touched tables (the client
- *  knows its own footprint — what the pending axis derives from, §7.2). The keyed methods validate
- *  column names eagerly: a typo'd table or column throws with the valid names listed, at the moment
- *  the mutator runs.
+/** Merge a fresh invocation's write-set into a `PendingMutation`'s accumulated one (§3.2 #1, rebase
+ *  re-invocation): each pk's value is OVERWRITTEN with the newest image (a later invocation ran
+ *  against the base the rebase just replaced, so its view supersedes the earlier one), but a key
+ *  present only in `dest` is left alone — the same union-never-shrink rule `touched` already
+ *  follows (§7.2: "a re-run that no-ops must NOT shrink it"). */
+function mergeWriteSet(dest, src) {
+    for (const [table, byPk] of src) {
+        let d = dest.get(table);
+        if (!d)
+            dest.set(table, (d = new Map()));
+        for (const [pkKey, rec] of byPk)
+            d.set(pkKey, rec);
+    }
+}
+/** The key a per-pk write source is stored under in {@link PendingMutation.writeSources}: `table`
+ *  + NUL + the pk-key (`stableJson(pk)`). NUL appears in neither a table name nor `stableJson`
+ *  output, so it is an unambiguous separator — the same key the confirm-drop hold-back reconstructs
+ *  from `(table, pkKey)` while iterating `writes`. */
+function writeSourceKey(table, pkKey) {
+    return `${table}\u0000${pkKey}`;
+}
+/** Zip the staged-order per-write source keys (`stagedKeys`, from `trackingTx`) with the staged-order
+ *  `sources[]` (`commitTracked`) into `dest`, last-write-per-key winning (§5.3). Never shrinks `dest`
+ *  — a rebase re-invocation MERGES its fresh routing in, mirroring {@link mergeWriteSet}. The two
+ *  arrays align 1:1: `trackingTx` pushes exactly one key per staged change, and `commitTracked`
+ *  returns one source per staged change, both in staged order. */
+function mergeWriteSources(dest, stagedKeys, sources) {
+    const n = Math.min(stagedKeys.length, sources.length);
+    for (let i = 0; i < n; i++)
+        dest.set(stagedKeys[i], sources[i]);
+}
+// --- the §3 router's pure helpers (H-iii) --------------------------------------------
+/** STRICT cell identity for the join-key no-change rule (§3 write rule #3): `===`, nothing more —
+ *  no coercion, no deep equality (a non-primitive join-key cell compares by reference and thus
+ *  conservatively fails), `NaN !== NaN` conservatively fails. Failing closed here only costs a
+ *  daemon route. */
+function identicalCell(a, b) {
+    return a === b;
+}
+/** Whether `cond` is decidable from the KEY ALONE: every column it references — collected from
+ *  BOTH operand positions (under-counting could over-claim decidability; over-counting only fails
+ *  closed — the H-iv-a discipline) — is a pk column. A `correlatedSubquery` is never key-local. */
+// Exported for test/predicate_agreement.test.ts — the TS corner of the cross-evaluator
+// agreement corpus (rust/rindle-room-core/tests/fixtures/predicate-agreement.json). NOT part of
+// the package surface (index.ts curates exports); the corpus is the drift tripwire that keeps
+// this evaluator honest against the engine + room-gate pair it shares no code with.
+export function keyDecidable(cond, pkCols) {
+    switch (cond.type) {
+        case "simple": {
+            if (cond.left.type === "column" && !pkCols.has(cond.left.name))
+                return false;
+            if (cond.right.type === "column" && !pkCols.has(cond.right.name))
+                return false;
+            return true;
+        }
+        case "and":
+        case "or":
+            return cond.conditions.every((c) => keyDecidable(c, pkCols));
+        case "correlatedSubquery":
+            return false;
+    }
+}
+/** Evaluate a key-decidable `footprintWhere` on a read's pk cells — H-iii's ONE client-side
+ *  non-engine evaluator, DELIBERATELY MINIMAL (the TS evaluation caveat on the router block
+ *  comment): `simple` `=`/`!=` between a pk COLUMN and a same-primitive-type NON-NULL literal,
+ *  composed under and/or. The empty AND — the compiler's vacuous-true emission for an exact
+ *  unconstrained footprint root — evaluates `true` (load-bearing: whole-table footprints keep
+ *  provable reads); the empty OR is vacuous-false. Returns `undefined` = NOT EVALUABLE for
+ *  anything else (other ops, null on either side, cross-type comparisons, column-vs-column,
+ *  literal-vs-literal, non-primitive cells, correlated subqueries) — the caller fails to the
+ *  daemon. A non-evaluable node anywhere poisons the whole tree (no short-circuit past it):
+ *  partial evaluation could otherwise claim a verdict the engine's semantics might contradict. */
+// Exported for test/predicate_agreement.test.ts (see keyDecidable's note above).
+export function evalFootprintOnPk(cond, pkCells) {
+    switch (cond.type) {
+        case "simple": {
+            if (cond.op !== "=" && cond.op !== "!=")
+                return undefined;
+            const col = cond.left.type === "column" ? cond.left : cond.right.type === "column" ? cond.right : undefined;
+            const lit = cond.left.type === "literal" ? cond.left : cond.right.type === "literal" ? cond.right : undefined;
+            if (col === undefined || lit === undefined)
+                return undefined; // column-vs-column / literal-vs-literal
+            if (!pkCells.has(col.name))
+                return undefined; // not a pk column (keyDecidable pre-screens)
+            const cell = pkCells.get(col.name);
+            const value = lit.value;
+            if (cell === null || value === null)
+                return undefined; // no null semantics client-side
+            if (typeof cell !== typeof value)
+                return undefined; // no cross-type comparison semantics
+            if (typeof cell !== "string" && typeof cell !== "number" && typeof cell !== "boolean")
+                return undefined;
+            return cond.op === "=" ? cell === value : cell !== value;
+        }
+        case "and": {
+            let out = true;
+            for (const c of cond.conditions) {
+                const v = evalFootprintOnPk(c, pkCells);
+                if (v === undefined)
+                    return undefined;
+                out = out && v;
+            }
+            return out;
+        }
+        case "or": {
+            let out = false;
+            for (const c of cond.conditions) {
+                const v = evalFootprintOnPk(c, pkCells);
+                if (v === undefined)
+                    return undefined;
+                out = out || v;
+            }
+            return out;
+        }
+        case "correlatedSubquery":
+            return undefined;
+    }
+}
+/** Wrap the raw wasm txn as the client `MutationTx`, capturing a pk-granular write-set as it
+ *  applies (`writes`, a {@link WriteSet} — table → pk-key → last-write-wins image, §3.2 #1);
+ *  `touched` (the pending axis's table-granular Set, §7.2) is derived by the CALLER as
+ *  `new Set(writes.keys())`, never populated here. The keyed methods validate column names eagerly:
+ *  a typo'd table or column throws with the valid names listed, at the moment the mutator runs.
+ *
+ *  With `trapReads` (the FOLDED path, §5), the PUBLIC reads `tx.get`/`tx.row`/`tx.query` throw
+ *  `FoldReadError` — a folded mutator that reads state to compute its write is non-absorbing and
+ *  refused. The keyed writers (`update`/`upsert`/`insertIgnore`/`delete`) still read internally to
+ *  preserve unspecified columns / check pre-existence; that is fold-legal (the trap wraps only the
+ *  returned object's `get`/`row`/`query` surface, never the writers' internal probe) — unchanged
+ *  by H-ii, which records those probes but arms recording only where the trap never is.
  *
- *  With `trapReads` (the FOLDED path, §5), the PUBLIC reads `tx.get`/`tx.row` throw `FoldReadError`
- *  — a folded mutator that reads state to compute its write is non-absorbing and refused. The keyed
- *  writers (`update`/`upsert`/`delete`) still read internally to preserve unspecified columns; that
- *  is column-preservation, not value-derivation, so it stays allowed. */
+ *  With `readLog` (recording mode, RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §3.2 #2) — a SIBLING
+ *  of `trapReads`, the two never armed together by any call site — the PUBLIC `tx.get`/`tx.row`
+ *  push a `(table, pk, outcome, source?)` {@link ReadRecord} (per-read provenance via the
+ *  `provenance` probe, H-ii §3.2 #3), `tx.query` pushes its resolved AST, and (H-ii) the keyed
+ *  writers' pre-existence probes record through the same path. Pure capture: it changes no return
+ *  value, throws nothing, and is a no-op when `readLog` is omitted. */
 /** Apply one logical {@link MutationOp} (yielded by a shared generator mutator) onto the client's
  *  keyed {@link MutationTx} — the same methods a plain client mutator calls directly. Column
- *  validation, touched-table tracking, and op collection all happen inside those methods. */
+ *  validation, write-set capture, and op collection all happen inside those methods. */
 function applyOpToTx(tx, op) {
     switch (op.kind) {
         case "insert":
@@ -1035,7 +2780,11 @@ function applyOpToTx(tx, op) {
             return tx.delete(op.table, op.pk);
     }
 }
-function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
+function trackingTx(tx, writes, specs, localTables, onOp, trapReads = false, readLog, stagedKeys, 
+/** Per-read provenance probe (H-ii §3.2 #3): called once per RECORDED present read with the
+ *  full-width row the read observed; meaningful only alongside `readLog` (never consulted when
+ *  recording is off — the fold and replay paths pass neither). */
+provenance) {
     const spec = (table) => {
         const s = specs[table];
         if (!s)
@@ -1069,6 +2818,26 @@ function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
         }
     };
     const pkCells = (table, obj) => spec(table).primaryKey.map((i) => obj[spec(table).columns[i]]);
+    // pk from the POSITIONAL wire shape (raw cells in schema column order) — the counterpart of
+    // `pkCells` (which reads a KeyedRow) for the raw `add`/`remove`/`edit` writers below (§3.2 #1).
+    const pkFromCells = (table, cells) => spec(table).primaryKey.map((i) => cells[i]);
+    // Record (or overwrite) this pk's write for the invocation (§3.2 #1): last-write-wins WITHIN
+    // this invocation — an add-then-edit (or edit-then-edit) of the same pk collapses to its final
+    // image, matching the engine head's own semantics for that pk. The record is replaced with
+    // exactly the arguments given: the CALLERS (`edit`/`remove` below, consulting `prior`) decide
+    // the pre-image per the H-ii coalescing matrix on {@link WriteRecord}.
+    const recordWrite = (table, pk, row, oldRow) => {
+        let byPk = writes.get(table);
+        if (!byPk)
+            writes.set(table, (byPk = new Map()));
+        const pkKey = stableJson(pk);
+        // Defensive copies: the wasm binding's returned arrays are not contractually immutable/unique,
+        // so a captured record must not alias a cell array the engine could later reuse or mutate.
+        byPk.set(pkKey, { table, pk: [...pk], row: row ? [...row] : undefined, ...(oldRow ? { oldRow: [...oldRow] } : {}) });
+        // Staged-order key trace (§5.3): pushed once per staged change, so it zips 1:1 with the staged
+        // order of `commitTracked`'s `sources[]` — letting the caller learn each write's routed source.
+        stagedKeys?.push(writeSourceKey(table, pkKey));
+    };
     // A full insert row: each cell is `obj[c]`, or `null` for an omitted nullable column (design 206
     // §6.2); a `json` object is stringified for the engine (`toCell`). Non-nullable columns are
     // guaranteed present by `checkColumns(full)`.
@@ -1081,27 +2850,97 @@ function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
         spec(table).columns.forEach((c, i) => (out[c] = cells[i]));
         return out;
     };
-    // Internal read — used by the keyed writers below and the keyed `row` reader; never trapped (for
-    // the FOLD trap) but ALWAYS guarded against local reads (M1).
+    // The raw, UN-recorded read primitive behind `getImpl`/`rowImpl` — the M1 local guard + the txn
+    // read, nothing else. Slice B deliberately kept the keyed writers (`update`/`upsert`/
+    // `insertIgnore`/`delete`) on this, un-recorded ("recording is about the PUBLIC read entry
+    // points"). H-ii deliberately REVERSES that: the pre-existence probe each keyed writer BRANCHES
+    // on is genuine value-dependence the §3 routing proof must see — the concrete silent-drop shape
+    // is `update("cards", {id:5,…})` where the client's daemon slice has the row but the room's
+    // footprint lacks it: the room-side update no-ops, the commit "succeeds" with zero effects, the
+    // confirm retires the entry, and the user's edit silently vanishes. The proof can only refuse
+    // that route if the probe is on the record. So the keyed writers now probe through `getImpl`
+    // (recorded like any public read, §3.2 #3); the FOLD trap is unaffected — it wraps only the
+    // returned object's `get`/`row`/`query` surface, so keyed writers stay fold-legal and the
+    // trapped path (where `readLog` is never armed) records nothing, exactly as before.
     const rawGet = (table, pk) => {
         assertNotLocal(table, "read");
         return tx.get(table, pk);
     };
+    // Push one {@link ReadRecord} when recording is armed (§3.2 #2/#3): outcome from `row`'s
+    // presence, per-read provenance probed with the observed FULL-WIDTH row — present reads only
+    // (an absent read has no row to probe with, and records no source; see {@link ReadRecord}).
+    // The `source` key is OMITTED (not set to undefined) when there is no answer, so a
+    // single-domain record is byte-identical to Slice B's.
+    const recordRead = (table, pk, row) => {
+        if (!readLog)
+            return;
+        const source = row === undefined ? undefined : provenance?.(table, row);
+        readLog.reads.push({
+            table,
+            pk: [...pk],
+            outcome: row === undefined ? "absent" : "present",
+            ...(source !== undefined ? { source } : {}),
+        });
+    };
+    // The PUBLIC positional read (§3.2 #2) — and, since H-ii, the keyed writers' pre-existence
+    // probe (§3.2 #3, see the `rawGet` note): `rawGet` plus a `readLog` record when recording is
+    // armed. A no-op record when `readLog` is omitted — exactly `rawGet`'s behavior then.
+    const getImpl = (table, pk) => {
+        const result = rawGet(table, pk);
+        recordRead(table, pk, result);
+        return result;
+    };
+    // The PUBLIC keyed read (§3.2 #2), the `row` counterpart of `getImpl`.
+    const rowImpl = (table, pk) => {
+        checkColumns(table, pk, false);
+        const pkc = pkCells(table, pk);
+        const cells = rawGet(table, pkc);
+        recordRead(table, pkc, cells);
+        return cells ? toKeyed(table, cells) : undefined;
+    };
+    // The pk's existing record from THIS invocation, if any — the coalescing-matrix input for
+    // `edit`/`remove` below (see {@link WriteRecord}).
+    const prior = (table, pk) => writes.get(table)?.get(stableJson(pk));
     const add = (table, row) => {
         assertNotLocal(table, "write");
-        touched.add(table);
+        recordWrite(table, pkFromCells(table, row), row);
         onOp?.({ table, kind: "add", row });
         tx.add(table, row);
     };
     const remove = (table, row) => {
         assertNotLocal(table, "write");
-        touched.add(table);
+        const pk = pkFromCells(table, row);
+        // The remove PRE-IMAGE (G-iii, §7.3 tombstone; the H-ii matrix on {@link WriteRecord}):
+        // remove-after-edit/-remove keeps the ORIGINAL captured pre-image (the txn-entry base — the
+        // net effect is a remove of the row the external world last knew, never the edited transient).
+        // Otherwise (first touch, or remove-after-add) the truthful full-width row is the txn-visible
+        // one — `tx.get` read BEFORE the remove stages (read-your-writes: an add of this pk earlier in
+        // the SAME invocation shows through). Captured NOW so Slice H's writable-predicate evaluation
+        // over it needs no migration. Falls back to the caller's asserted `row` when the pk is not
+        // resident (a raw remove of an absent row) — a captured remove thus always carries a
+        // full-width pre-image (the engine width-checks `holdBackAbsent`).
+        const oldRow = prior(table, pk)?.oldRow ?? tx.get(table, pk) ?? row;
+        recordWrite(table, pk, undefined, oldRow);
         onOp?.({ table, kind: "remove", row });
         tx.remove(table, row);
     };
     const edit = (table, oldRow, newRow) => {
         assertNotLocal(table, "write");
-        touched.add(table);
+        const pk = pkFromCells(table, newRow);
+        // The edit PRE-IMAGE (H-ii; the matrix on {@link WriteRecord}) — H-iii's join-key no-change
+        // input, and the row the engine routes the Edit by (H-i). First touch: the txn-visible row
+        // read BEFORE staging, falling back to the caller's asserted `oldRow` when the pk is not
+        // resident (covers the pk-MOVING raw edit — the record is keyed by the NEW pk; the pre-image
+        // carries the OLD row). Edit-after-edit: keep the FIRST pre-image (the txn-entry base).
+        // Edit-after-add / edit-after-remove: the record collapses to a (re-)insert — NO pre-image
+        // (the pk did not pre-exist this invocation's base).
+        const p = prior(table, pk);
+        const pre = p === undefined
+            ? (tx.get(table, pk) ?? oldRow)
+            : p.row !== undefined && p.oldRow !== undefined
+                ? p.oldRow
+                : undefined;
+        recordWrite(table, pk, newRow, pre);
         onOp?.({ table, kind: "edit", row: newRow, old: oldRow });
         tx.edit(table, oldRow, newRow);
     };
@@ -1119,28 +2958,27 @@ function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
         const ast = q.ast();
         for (const t of collectTables(ast))
             assertNotLocal(t, "read");
+        readLog?.queries.push(ast);
         return tx.query(ast);
     };
     return {
-        get: trapReads ? trapped : rawGet,
+        get: trapReads ? trapped : getImpl,
         query: trapReads ? trapped : runQuery,
         add,
         remove,
         edit,
-        row: trapReads
-            ? trapped
-            : (table, pk) => {
-                checkColumns(table, pk, false);
-                const cells = rawGet(table, pkCells(table, pk));
-                return cells ? toKeyed(table, cells) : undefined;
-            },
+        row: trapReads ? trapped : rowImpl,
         insert: (table, row) => {
             checkColumns(table, row, true);
             add(table, toCells(table, row));
         },
+        // The keyed writers' pre-existence probes go through `getImpl` — RECORDED reads since H-ii
+        // (§3.2 #3): each writer BRANCHES on the probe, a value-dependence the routing proof must see
+        // (the silent-drop rationale on `rawGet` above). Fold-legal exactly as before (the trap wraps
+        // the public surface above, never these), and byte-identical when recording is off.
         update: (table, row) => {
             checkColumns(table, row, false);
-            const current = rawGet(table, pkCells(table, row));
+            const current = getImpl(table, pkCells(table, row));
             if (!current)
                 return; // rebase-friendly: the row may have vanished upstream
             const s = spec(table);
@@ -1151,7 +2989,7 @@ function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
         },
         upsert: (table, row) => {
             checkColumns(table, row, true);
-            const current = rawGet(table, pkCells(table, row));
+            const current = getImpl(table, pkCells(table, row));
             if (current)
                 edit(table, current, toCells(table, row));
             else
@@ -1159,12 +2997,12 @@ function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
         },
         insertIgnore: (table, row) => {
             checkColumns(table, row, true);
-            if (!rawGet(table, pkCells(table, row)))
+            if (!getImpl(table, pkCells(table, row)))
                 add(table, toCells(table, row));
         },
         delete: (table, pk) => {
             checkColumns(table, pk, false);
-            const current = rawGet(table, pkCells(table, pk));
+            const current = getImpl(table, pkCells(table, pk));
             if (!current)
                 return; // rebase-friendly no-op
             remove(table, current);
@@ -1204,14 +3042,4 @@ function intersects(a, b) {
             return true;
     return false;
 }
-/** Elementwise equality over positional bare-cell rows (the synthetic `__agg` rows are all
- *  scalar cells — group key + count — so identity comparison suffices). */
-function rowsEqual(a, b) {
-    if (a.length !== b.length)
-        return false;
-    for (let i = 0; i < a.length; i++)
-        if (a[i] !== b[i])
-            return false;
-    return true;
-}
 //# sourceMappingURL=backend.js.map