@rindle/optimistic 0.4.4 → 0.5.0

package/src/backend.ts

@@ -59,11 +59,14 @@ import type {
   ChangeEvent,
   ColsMap,
   ColType,
+  Condition,
   IsoTx,
   KeyedRow,
   Mutation,
+  MutationEnvelope,
   MutationGen,
   MutationOp,
+  MutationOutcomeFrame,
   MutatorCtx,
   NormalizedEvent,
   NormalizedOp,
@@ -79,9 +82,21 @@ import type {
   WireValue,
 } from "@rindle/client";
 import { aggTableSchemas, NormalizedSync, rewriteAggregates, type ColCounts, type PkCols } from "@rindle/normalized";
-import { WasmBackend, type ServerDeltaOp, type WasmWriteTxn } from "@rindle/wasm";
+import { WasmBackend, type ServerDeltaOp, type WasmWriteTxn, type WritableDescriptor } from "@rindle/wasm";
 
 import { AggOverlay, type ChildOp, collectAggDefs } from "./agg-overlay.ts";
+import {
+  decodeOutcomeRow,
+  LIFECYCLE_TABLE_SCHEMAS,
+  ROOM_CLIENT_MUTATIONS_TABLE,
+  ROOM_MUTATION_OUTCOMES_TABLE,
+  ROOM_WATERMARK_TABLE,
+  roomDomainKey,
+  SCOPE_SESSIONS_TABLE,
+  type SystemStreamSpec,
+} from "./system-streams.ts";
+
+export type { SystemStreamSpec, SystemStreamTable } from "./system-streams.ts";
 
 /** A keyed row: column name → cell. The ergonomic shape — column names are validated against the
  *  schema at runtime, so a typo throws immediately with the valid names. Re-exported from
@@ -150,16 +165,242 @@ export type { ResultType };
  *  are assigned by the `Store` starting at 1, so 0 never collides. */
 const LMID_QID: QueryId = 0;
 
+/** One captured write, pk-granular (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §3.2 #1: "the
+ *  writers already receive `(table, row)`... this is pure capture, no semantic change"). `row` is
+ *  the post-write image (positional wire cells, schema column order); `undefined` for a `remove` —
+ *  no row survives it, and `row === undefined` stays the remove marker.
+ *
+ *  `oldRow` is the PRE-IMAGE, captured for a `remove` (G-iii, §7.3 tombstone) AND — since H-ii —
+ *  an `edit` (it feeds H-iii's join-key no-change rule, old vs new join-key cells, and mirrors the
+ *  engine, which routes an Edit by its OLD row — the H-i handoff): the full-width row read via
+ *  `tx.get` immediately BEFORE the write staged — read-your-writes, so a write to the same pk
+ *  earlier in the SAME invocation shows through — falling back to the caller's asserted old row
+ *  when the pk is not txn-visible (a raw remove/edit of an absent row; incl. the pk-MOVING raw
+ *  edit, whose record is keyed by the NEW pk yet whose pre-image is the caller's OLD row — the row
+ *  H-i's `provenanceOf` routes by). A captured remove/edit thus always carries a full-width
+ *  pre-image (the engine width-checks `holdBackAbsent`; Slice H evaluates writable predicates on
+ *  it) — with ONE exception: a record that collapses to a (re-)insert has none, see the matrix.
+ *
+ *  Coalescing within one invocation is last-write-wins per pk on `row` (the final image matches
+ *  the engine head's own semantics for that pk) with `oldRow` pinned to the TXN-ENTRY BASE — the
+ *  H-ii matrix:
+ *    - edit-after-add / edit-after-remove: the record collapses to a (re-)insert — post-image
+ *      only, NO `oldRow` (the pk did not pre-exist this invocation's base; presence hold-back
+ *      uses `row`).
+ *    - edit-after-edit: keeps the FIRST pre-image (the txn-entry base — the chain nets to ONE
+ *      edit from the base to the final image).
+ *    - remove-after-edit / remove-after-remove: keeps the ORIGINAL pre-image (the first write's
+ *      captured base), NOT the edited transient — the net effect is a remove of the row the
+ *      external world last knew.
+ *    - remove-after-add: keeps the txn-visible pre-image (the transient added row — the pk had
+ *      no base, and this is the only truthful full-width row there is; G-iii pinned it).
+ *    - add-after-remove (a re-insert): drops `oldRow` (presence hold-back uses `row`).
+ *  Across rebase re-invocations the write-set is union-never-shrink ({@link mergeWriteSet}): a
+ *  re-run that no-ops keeps the prior record — and its pre-image — intact. */
+export interface WriteRecord {
+  table: string;
+  pk: WireValue[];
+  row: WireValue[] | undefined;
+  oldRow?: WireValue[];
+}
+
+/** The pk-granular write-set captured over ONE mutator invocation: table → pk-key (a stable-JSON
+ *  encoding of the pk cells, {@link stableJson}) → that pk's write, LAST-WRITE-WINS within the
+ *  invocation — an add-then-edit or edit-then-edit of the SAME pk collapses to its final image,
+ *  matching the engine head's own semantics for that pk. Chosen (over a flat array) because the
+ *  later routing proof needs "is pk P in the writable scope" / "did we already see this pk in this
+ *  invocation" as cheap lookups, and rebase re-invocation needs to MERGE a fresh write-set into an
+ *  accumulated one ({@link mergeWriteSet}) — both are Map operations, not scans.
+ *
+ *  `touched` (the pre-existing table-granular `Set<string>` the pending axis reads, §7.2) is
+ *  exactly `new Set(writeSet.keys())` — derived from this, never separately populated, so the two
+ *  can never drift. */
+export type WriteSet = Map<string, Map<string, WriteRecord>>;
+
+/** Whether a recorded point read (`tx.get`/`tx.row`) found a row. */
+export type ReadOutcome = "present" | "absent";
+
+/** One recorded point read, pk-granular (§3.2 #2). Recording-mode only — see {@link ReadLog}.
+ *  Since H-ii this covers BOTH the public reads (`tx.get`/`tx.row`) and the keyed writers'
+ *  internal pre-existence probes (§3.2 #3 — see the `rawGet` note in {@link trackingTx}). */
+export interface ReadRecord {
+  table: string;
+  pk: WireValue[];
+  outcome: ReadOutcome;
+  /** Per-read provenance (H-ii, §3.2 #3): the engine's `provenanceOf` answer AT THE MOMENT OF THE
+   *  READ — which source ("daemon" / a room key) served the row the mutator saw. Live pre-commit
+   *  state: an open txn's staged writes are not consulted (H-i), so a PRESENT read of a pk this
+   *  txn itself created reports `undefined` — recorded honestly, key omitted (the router treats
+   *  self-reads via write-set membership, not provenance). ABSENT reads carry no source (the
+   *  mutator saw no row; there is no full-width row to probe with — a pk this txn staged-removed
+   *  thus also records `undefined`, again a write-set-membership case for the router). Probed only
+   *  on a PROMOTED table ({@link promotedTables}): a never-promoted (Collapsed) table is
+   *  daemon-owned by construction, so a pure single-domain app pays zero wasm calls per read and
+   *  `undefined` is still correct (everything is daemon-owned). One probe call per recorded
+   *  present read, at read time. */
+  source?: string;
+}
+
+/** The read-log captured over ONE mutator invocation when recording is armed (RINDLE-REALTIME-
+ *  QUERY-ENABLEMENT-DESIGN.md §3.2 #2): every point read (`reads` — the public `tx.get`/`tx.row`
+ *  and, since H-ii, the keyed writers' internal pre-existence probes) plus every resolved query AST
+ *  (`queries`, from `tx.query`). A SIBLING of the folded read TRAP (`FoldReadError` below) — the
+ *  trap arms on the folded path and throws before any read completes (recording never runs there);
+ *  recording arms on the ordinary (non-folded) prediction run and never throws. Pure capture: which
+ *  row/predicate a read is actually PROVEN covered by (§3.1's table) is a later slice's job. */
+export interface ReadLog {
+  reads: ReadRecord[];
+  queries: Ast[];
+}
+
+/** One promoted `(sourceKey, table)`'s client-held routing spec — THE per-table routing record the
+ *  §3 prove-or-slow-path router reads (H-iii). Recorded by {@link OptimisticBackend.promoteRoomTable}
+ *  in the same breath as the engine attach, from the lease's `RealtimeLeaseTableSpec` (the
+ *  api-server's `RoomTableSpec`, one compiler with the boot wire).
+ *
+ *  - `writable`: whether the room may write this table AT ALL — `true` iff the registered engine
+ *    {@link WritableDescriptor} is not `none` (a context/"followed" table is `none`; the daemon
+ *    stays write-authoritative for it, §2.2). Rule #1 of the write proof.
+ *  - `joinKeyCols`: the correlation columns the footprint binds on this table — the "room mutators
+ *    never change join keys" input (an edit with a moved join-key cell would re-parent the row
+ *    across the footprint's correlation and is refused room-routing). Deliberately client-side —
+ *    they never cross the wasm {@link WritableDescriptor} ABI (the room GATE enforces them
+ *    engine-side, H-iv).
+ *  - `where`: the lease's row-local writable predicate (advisory here — the router evaluates the
+ *    ENGINE's compiled copy via `writableMatches`, never this one; kept for introspection parity
+ *    with the wire).
+ *  - `footprintWhere`: the EXACT footprint-membership predicate (H-iv-b: root-node-only, lossless
+ *    extraction; the vacuous-true `{type:"and",conditions:[]}` for an exact unconstrained root;
+ *    ABSENT for child/correlated tables). The read proof's pk-membership test input — see
+ *    {@link OptimisticBackend.deriveDomain}. */
+export interface RoomTableRouting {
+  writable: boolean;
+  joinKeyCols: string[];
+  where?: Condition;
+  footprintWhere?: Condition;
+}
+
+/** The per-table spec {@link OptimisticBackend.promoteRoomTable} receives beside the engine
+ *  descriptor (H-iii spec plumbing) — the wire-facing half of {@link RoomTableRouting}
+ *  (`writable` is derived from the descriptor's kind, never passed separately). */
+export interface RoomTableRoutingSpec {
+  joinKeyCols?: readonly string[];
+  where?: Condition;
+  footprintWhere?: Condition;
+}
+
+/** The §3 router's Q6 measurement hook ({@link OptimisticBackend.__inspectDomains}`().routing`):
+ *  how often derivation succeeded (per derived room) and why it fell back to the daemon (per
+ *  failure reason). `reasons` counts PER-CANDIDATE proof failures plus the terminal reasons
+ *  (`no-candidates` / `tx-query` / `ambiguous`) — with multiple candidate rooms one derivation can
+ *  bump several reason counters (one per failing candidate), and a candidate's failure is counted
+ *  even when a sibling candidate ultimately proved. Explicit-policy pins bump NOTHING (the router
+ *  never ran). */
+export interface RoutingInspect {
+  /** Successful DERIVED routes, per room key. */
+  derived: Record<string, number>;
+  /** Derivation failures, per {@link RoutingFailureReason}. */
+  reasons: Record<string, number>;
+}
+
+/** Why a §3 derivation (or one candidate's proof) fell to the daemon — the {@link RoutingInspect}
+ *  counter keys. */
+export type RoutingFailureReason =
+  /** No connected room gate with a promoted table — the single-domain fast path. */
+  | "no-candidates"
+  /** The invocation ran `tx.query` — a declarative read is not room-provable client-side
+   *  (rindle-cover is native-only BY DESIGN), so the whole derivation fails unconditionally. */
+  | "tx-query"
+  /** Two or more candidate rooms both proved. Principled disambiguation is a §9.2 (multi-room
+   *  clients + budgets) NON-goal, deferred past Slice J; routing slow is always sound (the §3.3
+   *  gate is the contract). Reachable essentially only for zero-write mutations — real writes
+   *  can't be writable in two rooms (§2.2 exactly-one-writer per doc). */
+  | "ambiguous"
+  /** A write touched a table not promoted for the candidate, or promoted `writable: none`
+   *  (context) — the room may not write it at all. */
+  | "write-unwritable-table"
+  /** `writableMatches` refused the write's post-image (add/edit) or pre-image (remove). */
+  | "write-scope-miss"
+  /** An edit moved a join-key cell (old vs new differ on a `joinKeyCols` column). */
+  | "write-join-key-change"
+  /** The engine's provenance for the write's probe row names a DIFFERENT room. */
+  | "write-cross-room-provenance"
+  /** A recorded read was served by a DIFFERENT room. */
+  | "read-cross-room"
+  /** A read needed the pk-membership test but the table has no `footprintWhere` (child /
+   *  correlated / inexact extraction / never-promoted table). */
+  | "read-no-footprint-where"
+  /** `footprintWhere` references a non-pk column — not decidable from the key alone. */
+  | "read-not-key-decidable"
+  /** `footprintWhere` is key-decidable but outside the deliberately-minimal client evaluator
+   *  (an op other than `=`/`!=`, a null/type-mixed comparison, column-vs-column, …). */
+  | "read-not-evaluable"
+  /** `footprintWhere` evaluated FALSE on the read's pk — the room provably never holds it. */
+  | "read-outside-footprint"
+  /** NOT a derivation failure (H-v): a routed mutation came back `mutationOutcome
+   *  {kind:"deopt"}` — the room GATE refused it at commit and the client re-enqueued it onto the
+   *  daemon. Counted per processed deopt frame so Q6's picture is complete: derived-and-deopted
+   *  routes are visible beside derived successes (a rising `deopt` count against a rising
+   *  `derived` count means the client proof and the gate disagree — a compiler/evaluator skew
+   *  worth investigating; each one costs a room round-trip + a burnt room mid, never
+   *  correctness). */
+  | "deopt";
+
 interface PendingMutation {
   /** The wire mutation id. A FOLDED entry carries `null` until its window flushes — the `mid`
    *  is dealt from `nextMid` in SEND order, never reserved at invoke, so the wire sequence stays
    *  gapless under debounce (FOLDED-MUTATIONS-DESIGN §4.1). A `null` entry is never confirmable
-   *  (the confirm-drop retains it) and re-invokes AFTER every assigned mid (sorted by `mid ?? ∞`). */
+   *  (the confirm-drop retains it) and re-invokes AFTER every assigned mid. */
   mid: number | null;
+  /** The client-global deal sequence, stamped in the same breath as {@link mid} (`null` while the
+   *  mid is). Mids are PER-DOMAIN (each authority numbers its own confirms, §7.1), so mids from
+   *  different domains are incomparable — a daemon mid 5 and a room mid 1 say nothing about which
+   *  was sent first. `seq` is the ONE total order across domains: **confirmation order is
+   *  per-domain; replay order is client-global** — the reconcile's re-invocation sort keys on
+   *  `seq`, never on `mid`. Within one domain `seq` order equals `mid` order (both dealt at the
+   *  same send-time choke point) EXCEPT across an H-v deopt re-enqueue: a flipped entry keeps its
+   *  ORIGINAL seq while its fresh daemon mid is dealt later, so its seq may undercut daemon
+   *  entries with smaller mids. That is the point — seq is the REPLAY order and the flip must not
+   *  move the entry's overlay position (a read-dependent sibling invoked after it replays on its
+   *  value); the only consumer of the ordering is the seq-keyed reconcile sort, which wants
+   *  exactly this. Single-domain behavior without deopts is unchanged. */
+  seq: number | null;
   name: string;
   args: unknown;
-  /** Tables this mutator touched at its LAST invocation (drives the pending axis, §7.2). */
+  /** The confirming stream (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1): which domain's ledger
+   *  dealt this entry's `mid` and whose confirm watermark can retire it. Resolved from the injectable
+   *  `domainPolicy` when the mid is dealt (for a folded entry, re-resolved at flush). `"daemon"` in
+   *  the single-domain configuration. An un-flushed fold (`mid == null`) carries its provisional
+   *  domain but is never confirmable until the flush stamps a real mid. */
+  domain: string;
+  /** Tables this mutator touched at its LAST invocation (drives the pending axis, §7.2). Derived
+   *  from `writes.keys()` — see {@link WriteSet}. */
   touched: Set<string>;
+  /** The pk-granular write-set captured at this entry's LAST invocation (§3.2 #1). A rebase
+   *  re-invocation MERGES its fresh write-set into this one ({@link mergeWriteSet}), mirroring the
+   *  `touched` union: the key set only grows across re-invocations (a re-run that no-ops must not
+   *  shrink it, §7.2), each key's value is always the newest. */
+  writes: WriteSet;
+  /** The physical SOURCES this mutator's writes staged onto (RINDLE-REALTIME-QUERY-ENABLEMENT-
+   *  DESIGN.md §5.3, from `commitTracked`) — `{"daemon"}` in single-domain. Drives the per-source
+   *  reconcile FILTER: `runReconcileCycle(sourceKey)` re-invokes an entry only if it wrote onto
+   *  `sourceKey` (its writes there were un-applied by that source's rewind; other-source writes are
+   *  intact). Union-merged across re-invocations, never shrunk (like `touched`). DISTINCT from
+   *  {@link domain} (which stream CONFIRMS it): a room-domain mutation whose write routed to the
+   *  daemon slice (a fresh pk) has `domain === "room:doc:X"` but `touchedSources ∋ "daemon"`. */
+  touchedSources: Set<string>;
+  /** Per staged (table, pk) → the source it routed onto ({@link writeSourceKey}), aligned from
+   *  `commitTracked`'s staged-order `sources[]` (last write to a pk wins). Read at the confirm-drop
+   *  to fire the §7.3 echo hold-back for a write whose source ≠ its confirming {@link domain}.
+   *  All `"daemon"` in single-domain (inert). Merged never-shrunk across re-invocations. */
+  writeSources: Map<string, string>;
+  /** The read-log captured at this entry's LAST *recorded* invocation (§3.2 #2). Empty for a
+   *  FOLDED entry (the trap, not recording, arms on that path — nothing is ever recorded there)
+   *  and left as the ORIGINAL invoke's log across a rebase re-invocation: recording is armed only
+   *  on the initial `invoke`, not the reconcile replay (a re-invocation runs against a rebased
+   *  base, so its read outcomes would need re-proving against the NEW base anyway — re-arming
+   *  recording there is future work, not required for pure capture). */
+  reads: ReadLog;
 }
 
 /** A virtual-clock seam for the fold debounce/maxWait timers (FOLDED-MUTATIONS-DESIGN §9): the
@@ -180,6 +421,15 @@ export interface FoldOptions {
   /** Hard cap so a never-idle drag still persists periodically (trailing throttle). Unbounded if
    *  omitted — an idle gap of `debounceMs` is then the only thing that flushes. */
   maxWaitMs?: number;
+  /** §9.3 room-aware cadence. When this fold's write ROUTES INTO A ROOM (a collaborator is live on
+   *  the shared head), flush at this (short) interval instead of `debounceMs`/`maxWaitMs`, so the
+   *  intermediate frames STREAM to the room rather than collapsing to last-value-wins — the pen is
+   *  watched, so its growth matters. OFF the room (solo / daemon-served) this is ignored and the
+   *  caller's `debounceMs` collapse governs. `0` ⇒ per-frame (never coalesce while in a room); a
+   *  small value (e.g. 40ms) animates while still capping the write rate. Absent ⇒ same cadence
+   *  room or not (today's behavior). The room decision is probed from the write-set at the fold
+   *  window's first invoke; it stays fixed for that window. */
+  roomDebounceMs?: number;
   /** Keep deferring across overlapping non-fold writes for maximum economy, accepting the §4.2
    *  read-dependent reorder snap. Default `false` (flush-on-enqueue — correct-and-boring). */
   deferAcrossWrites?: boolean;
@@ -224,6 +474,112 @@ interface BufferedFrame {
   seq: number;
 }
 
+/** ONE authority channel's coherence gate (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §5.1): the
+ *  per-source generalization of what used to be the backend's single `(buffer, appliedCv)` pair.
+ *  Each connected source — the daemon always; a `room:doc:X` once Slice G wires the live feed —
+ *  buffers its own cv-tagged frames and releases on its OWN `cvMin`, an independent cycle feeding
+ *  the one `applyRelease`: **coherent within a source; eventual across sources** (no joint
+ *  barrier, by design). `key` doubles as the lmid fold domain (§7.1) and the physical source the
+ *  release rebases (§5.3). `sync` is this source's OWN refcount/baseline space — folding two
+ *  sources through one `NormalizedSync` would refcount an overlapping row 1→2 and emit NOTHING
+ *  for the second source, silently starving its per-source baseline (§5.2 "a real store: its own
+ *  baseline"). */
+interface SourceGate {
+  key: string;
+  source: OptimisticSource;
+  sync: NormalizedSync;
+  buffer: BufferedFrame[];
+  /** Arrival counter behind {@link BufferedFrame.seq}, scoped to THIS gate's buffer. */
+  nextSeq: number;
+  appliedCv: number;
+  /** The channel's latest UPSTREAM-absorption advert (§301 direction B, a ROOM gate only): "I
+   *  have absorbed upstream daemon commits through cv `upstreamCv` of boot `upstreamBoot`" —
+   *  recorded verbatim from each {@link ProgressFrame} ({@link OptimisticBackend.onGateProgress})
+   *  so the drop pass that runs at that release's tail reads exactly this release's advert.
+   *  `undefined` until the shell advertises (an old shell never does — the §2.5 skew fallback);
+   *  cleared on a channel restart (the fresh incarnation re-advertises). */
+  upstreamBoot?: string;
+  upstreamCv?: number;
+}
+
+/** One I-iv doorbell event ({@link OptimisticBackend.onScopeSessions}, §4.1): a release folded
+ *  scope-session rows for `scope`, and `others` is the count of OTHER clients' unexpired sessions
+ *  there — {@link OptimisticBackend.otherScopeSessions} evaluated at fold time (the same one rule,
+ *  on the injectable {@link FoldClock}, so a virtual-clock harness gets deterministic verdicts).
+ *  The consumer (client.ts) triggers its one debounced re-lease on the 0→≥1 transition; expired
+ *  and own-clientID rows never count, so a solo client's own row can never ring its own bell. */
+export interface ScopeSessionsEvent {
+  scope: string;
+  others: number;
+}
+
+/** One demoted room source's §4.2 ghost record (Slice I-v): the room slice stays FROZEN in the
+ *  merge (wins-if-present — still supplying the visible rows, accepting nothing) until the
+ *  daemon plane has provably absorbed the room's final flush. The drop condition is evaluated
+ *  after every release ({@link OptimisticBackend.evaluateGhosts}):
+ *
+ *    `roomWatermarks[doc] ≥ finalFlushSeq`  (0 ⇒ trivially true — a never-flushed room)
+ *    AND no pending mutation with `domain === sourceKey` remains (sent-pins-domain, §7.5 —
+ *    room-domain entries retire ONLY through the outcome-resolved daemon-carried folds, I-iii).
+ */
+interface RoomGhost {
+  doc: string;
+  finalFlushSeq: number;
+  /** Every table promoted for the sourceKey at demote time — the {@link dropGhost} removal set
+   *  (and, while the ghost lives, its hold on the {@link promotedTables} record). */
+  tables: string[];
+  /** Whether the ONE stuck-downgrade event already fired for this ghost. */
+  stuckReported: boolean;
+}
+
+/** The I-v stuck-downgrade event ({@link OptimisticBackend.onDowngradeStuck}): the ghost's fence
+ *  is satisfied but these SENT room-domain mids never resolved (an entry that never reached the
+ *  room — sent-but-undelivered when the socket died — is undecidable in general, §7.5). The ghost
+ *  HOLDS (fail LOUD, never silent; no timeout-retire is invented) and the mids are surfaced once,
+ *  actionably. */
+export interface DowngradeStuckEvent {
+  sourceKey: string;
+  doc: string;
+  mids: number[];
+}
+
+/** One §301 echo-fence pin (`301-ECHO-FENCE-DESIGN.md` §2.1): the client-side registry entry for
+ *  a parked engine hold-back, carrying the DELIVERY-fence inputs the engine deliberately does not
+ *  know. Parked in the same breath as `holdBack`/`holdBackAbsent` at the §7.3 confirm-drop; keyed
+ *  `${table}\0${sourceKey}\0${pkKey}` so a re-park of the same slice-pk overwrites (matching the
+ *  engine's `held_back.insert`). The fence per direction (§1):
+ *
+ *   - **A** (`sourceKey === "daemon"`, a room-domain write staged on the daemon slice): drops
+ *     when the DAEMON-CARRIED room ledger covers `mid` — {@link OptimisticBackend}'s
+ *     `daemonCarriedLmid[domain] ≥ mid` (the I-ii co-commit puts the flush data in the same
+ *     coherent release, §1.1).
+ *   - **B** (a room `sourceKey`, `domain === "daemon"`): drops when the room gate advertises
+ *     absorption at-or-past the parking daemon release — `(upstreamBoot, upstreamCv)` covers
+ *     `(daemonBoot, daemonCv)` under the §2.4 boot rule.
+ *   - a room-staged pin confirmed by ANOTHER room has no fence (out of today's two-tier
+ *     topology); it drops only via the engine's state-match fallback. */
+interface EchoFencePin {
+  table: string;
+  /** The staged slice holding the engine pin — what to drop ON. */
+  sourceKey: string;
+  /** The held row / pre-image (full-width; the pk derives from it) — what to drop AT. */
+  probeRow: WireValue[];
+  /** The confirming domain (direction A's ledger to watch). */
+  domain: string;
+  /** The confirmed wire mid (direction A's fence input). */
+  mid: number;
+  /** Direction B stamps (301 §1.2): the parking daemon release's coherence position + the
+   *  client-observed daemon boot it belongs to. Absent on direction A / the no-fence shape. */
+  daemonBoot?: string;
+  daemonCv?: number;
+  /** The slice's confirmed-baseline row at park — the §2.5 stuck-pin tripwire's "has the
+   *  baseline CHANGED VALUE since park" reference (that change is the suspicious state that
+   *  precedes every forever-pin). */
+  baselineAtPark?: WireValue[];
+  /** The tripwire's log-once latch. */
+  tripwired?: boolean;
+}
+
 export interface OptimisticBackendOptions {
   /** Stable per-client identity for the upstream envelopes (§8.1). */
   clientID: string;
@@ -237,6 +593,23 @@ export interface OptimisticBackendOptions {
   /** Virtual-clock seam for the fold debounce timers (FOLDED-MUTATIONS-DESIGN §9). Defaults to
    *  real `setTimeout`/`clearTimeout`/`Date.now`; the fold oracle injects a deterministic clock. */
   clock?: FoldClock;
+  /** The explicit confirming-stream OVERRIDE (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1 /
+   *  §3). Since H-iii the live default is the §3 prove-or-slow-path DERIVATION
+   *  ({@link OptimisticBackend.deriveDomain}): a configured policy returning a string pins that
+   *  domain VERBATIM — no proof runs (the test suites and the dual-source e2e pin by name);
+   *  returning `undefined` (or configuring no policy) derives the domain from the prediction run's
+   *  write/read capture against the connected room gates' routing table. With no room gate
+   *  connected the derivation short-circuits to `"daemon"` — every single-domain app is
+   *  byte-for-byte as before. */
+  domainPolicy?: (name: string, args: unknown) => string | undefined;
+  /** A FINAL (authz/validation) mutation rejection's reason surface — the room plane's twin of the
+   *  HTTP mutate route's `onRejected` (H-v; the H-iv-b `mutationOutcome {kind:"rejected"}` frame).
+   *  The prediction's snap-back is NOT this callback's job: the room burns the mid and its lmid
+   *  release drops the entry exactly as a daemon-path rejection does (processed-as-no-op) — this
+   *  is where the REASON reaches the app, same contract as the queue's callback. Also invoked when
+   *  a DEOPT's fresh re-invocation (the already-retired arm) throws — that mutation is dead on the
+   *  current base with no stream left to confirm it, the closest thing to a rejection there is. */
+  onRejected?: (envelope: MutationEnvelope, reason: string) => void;
 }
 
 // --- dev-only introspection (DEBUG-TOOLS-BROWSER-DESIGN §2/§4.1) -----------------
@@ -268,6 +641,13 @@ export interface PendingInspect {
   args: unknown;
   /** Tables this mutator touched at its last (re)invocation — the pending-axis basis (§7.2). */
   tables: string[];
+  /** The pk-granular write-set captured at this entry's LAST invocation (RINDLE-REALTIME-QUERY-
+   *  ENABLEMENT-DESIGN.md §3.2 #1), flattened from the {@link WriteSet} map for inspection — one
+   *  entry per `(table, pk)` currently held. Pure capture; no routing consumer yet. */
+  writes: WriteRecord[];
+  /** The read-log captured at this entry's LAST *recorded* invocation (§3.2 #2). Empty for a
+   *  folded entry — the read TRAP arms there, not recording (see {@link PendingMutation.reads}). */
+  reads: ReadLog;
   /** Present iff this entry is a folded (debounced) write. */
   fold?: FoldInspect;
 }
@@ -299,6 +679,15 @@ const REAL_CLOCK: FoldClock = {
   now: () => Date.now(),
 };
 
+/** The (shared, frozen-by-convention) empty map {@link OptimisticBackend.roomTablesFor} answers
+ *  for a room with no promoted tables. */
+const EMPTY_ROUTING: ReadonlyMap<string, RoomTableRouting> = new Map();
+
+/** Per-domain retention cap for the processed-outcome set (H-v) — mirrors the shell's
+ *  `MAX_RECORDED_OUTCOMES_PER_CLIENT`: the sender caps what it can re-answer at 512 per client,
+ *  so remembering more than 512 processed mids per domain buys nothing. */
+const MAX_PROCESSED_OUTCOMES_PER_DOMAIN = 512;
+
 export class OptimisticBackend<S extends ColsMap> implements Backend {
   private readonly local: WasmBackend<S>;
   private readonly sync: NormalizedSync;
@@ -321,6 +710,9 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
    *  its width check. */
   private readonly colCounts: ColCounts;
   private readonly colIndex: Record<string, Map<string, number>>;
+  /** Per-table pk column indices — held so `connectSource` can build a fresh per-source
+   *  `NormalizedSync` with the same layout the daemon's uses. */
+  private readonly pkCols: PkCols;
   /** The client's OWN typed per-table schemas + the reserved lmid table — the fixed base
    *  of the expected-schema set (CRIT#4 validation). Synthetic agg tables are appended as
    *  queries arrive (`ensureSyntheticTables`). */
@@ -345,6 +737,12 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
   // only for the duration of the reconcile cycle in `onProgress`; a re-hydrate after a drop is a real
   // footprint diff (genuine change) and is NOT remapped. See {@link ChangeEvent} `catchUp`.
   private catchUpQids: Set<QueryId> | null = null;
+  /** Newly-hydrated qids whose reconcile ACTUALLY emitted a (catch-up-stamped) batch — recorded by the
+   *  local-event forwarder alongside {@link catchUpQids}. After the reconcile, any newly-hydrated qid
+   *  NOT in here folded nothing (0 rows, or its result already present via a sibling → 0 net muts, or
+   *  the reconcile was skipped), so `onProgress` sends it an explicit empty catch-up — else its SSR
+   *  seed would never retire (the view freezes). Non-null only for the reconcile's duration. */
+  private catchUpEmitted: Set<QueryId> | null = null;
   /** The Store's commit-boundary handler ({@link Backend.onCommitBoundary}), forwarded from the
    *  local engine's `dispatch` brackets so the Store folds every affected view before notifying any
    *  subscriber (cross-view-atomic notification). All this backend's data deltas originate from the
@@ -353,18 +751,142 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
   private readonly devObservers = new Set<BackendDevObserver>();
 
   private pendingMutations: PendingMutation[] = [];
-  private nextMid = 1;
+  /** The next mid to deal, PER DOMAIN (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1): a client
+   *  writing through room + daemon concurrently must not alias one lmid counter. Seeded with the
+   *  `"daemon"` stream at 1; a domain absent from the map starts at 1. In the single-domain
+   *  configuration only `"daemon"` is ever touched, so the sequence is byte-for-byte as before. */
+  private nextMid = new Map<string, number>([["daemon", 1]]);
+  /** The client-global deal counter behind {@link PendingMutation.seq}: one sequence across ALL
+   *  domains, bumped whenever any domain's mid is dealt. The replay order (mids are per-domain and
+   *  incomparable across domains — see the `seq` field doc). */
+  private dealSeq = 0;
+  /** The explicit confirming-stream override (§7.1/§3) — see
+   *  {@link OptimisticBackendOptions.domainPolicy}. `undefined` from it ⇒ H-iii derivation. */
+  private readonly domainPolicy: (name: string, args: unknown) => string | undefined;
+  /** The final-rejection reason surface ({@link OptimisticBackendOptions.onRejected}). */
+  private readonly rejectedHandler: (envelope: MutationEnvelope, reason: string) => void;
+  /** Processed `(domain, mid)` outcome frames (H-v) — the deopt handshake's idempotence guard: a
+   *  duplicate frame (the original plus a reconnect re-send's re-answer, or two re-answers across
+   *  two reconnects) must not double-invoke. Needed precisely because a deopt frame can arrive for
+   *  an ALREADY-RETIRED mid (the replay gotcha) — "no matching entry" alone cannot distinguish
+   *  "handle it fresh" from "already handled". Per-domain FIFO, capped like the shell's
+   *  recorded-outcome map ({@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}); past the cap a duplicate of
+   *  an evicted mid would be re-processed — the same bounded-window trade the shell makes, and it
+   *  takes 512 interleaving non-applied outcomes on one domain to open it. */
+  private readonly outcomesProcessed = new Map<string, Set<number>>();
+  /** THE routing table (H-iii §3): per connected room `sourceKey` → per promoted table → its
+   *  client-held {@link RoomTableRouting}. Written ONLY by {@link promoteRoomTable} (same breath
+   *  as the engine attach + {@link promotedTables}); read by {@link deriveDomain} and — via
+   *  {@link roomTablesFor} — the client's `__realtimeInspect` bookkeeping. */
+  private readonly roomRouting = new Map<string, Map<string, RoomTableRouting>>();
+  /** Q6 counters ({@link RoutingInspect}): successful derivations per room. */
+  private readonly routingDerived = new Map<string, number>();
+  /** Q6 counters ({@link RoutingInspect}): derivation failures per {@link RoutingFailureReason}. */
+  private readonly routingReasons = new Map<string, number>();
   /** The live fold entries, by fold key `${name}\0${identityJSON}` — at most one per key
    *  (FOLDED-MUTATIONS-DESIGN §8). Insertion order is creation order (the drain/flush tiebreak). */
   private readonly folds = new Map<string, FoldRecord>();
   /** The fold debounce clock (real timers by default; the oracle injects a virtual one). */
   private readonly clock: FoldClock;
-  /** The high-water confirmed mutation id, folded from the lmid system query's
-   *  RELEASED ops (lmid-as-data) — never from a frame. */
-  private confirmedLmid = 0;
-  private buffer: BufferedFrame[] = [];
-  private nextSeq = 0;
-  private appliedCv = 0;
+  /** The high-water confirmed mutation id, PER DOMAIN (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md
+   *  §7.2 per-domain confirm-drop): an entry with `mid <= watermark[entry.domain]` has been
+   *  confirmed. The `"daemon"` domain is folded from the lmid system query's RELEASED ops
+   *  (lmid-as-data) — never from a frame; a room domain will fold from its own lmid stream (later
+   *  slice). Seeded with `"daemon"` at 0; the daemon scalar `confirmedLmid` (devtools) is
+   *  `watermark.get("daemon")`. */
+  private watermark = new Map<string, number>([["daemon", 0]]);
+  /** The per-source coherence gates (§5.1), by source key. Seeded with the daemon gate at
+   *  construction; a room channel attaches later (`connectSource`). Single-domain: one entry,
+   *  and every gate-generalized path degenerates to the old single-buffer code. NOT the same
+   *  space as {@link watermark}/{@link nextMid}: a DOMAIN can confirm with no gate connected
+   *  (the `__testRelease` seam); a gate's `key` names the domain its lmid stream folds into. */
+  private readonly gates = new Map<string, SourceGate>();
+  /** The daemon's gate — the always-present channel (constructor-attached). The devtools
+   *  scalars (`__inspect`) read it directly; its `sync` IS {@link sync} (the agg overlay and
+   *  synthetic tables are daemon-tracked by design). */
+  private readonly daemonGate: SourceGate;
+  /** Tables promoted to a MERGED multi-source engine (a room source attached). Written by the one
+   *  promotion seam ({@link promoteRoomTable}; the test-named {@link __addRoomSource} and Slice
+   *  G-v's lease-driven promotion from `RoomTableSpec[]` both flow through it). Read by the §7.3
+   *  hold-back trigger in
+   *  {@link applyRelease}: parking on a never-promoted (Collapsed) table is SKIPPED — inert anyway
+   *  today (`rewind_collapsed` never consults `held_back`), and a live hazard if the table later
+   *  promotes (a stale Collapsed-era entry turns overlay-first-visible and pins forever). Slice H's
+   *  prove-or-slow-path routing keeps the real scenario — a room-confirmed mutation writing a
+   *  Collapsed table — impossible; this gate covers the window until then. */
+  private readonly promotedTables = new Set<string>();
+  /** The §301 pin registry ({@link EchoFencePin}): every parked §7.3 hold-back's delivery-fence
+   *  inputs, keyed `${table}\0${sourceKey}\0${pkKey}`. Written in the same breath as the
+   *  `holdBack`/`holdBackAbsent` park; read by {@link dropEchoFencePins} at the tail of every
+   *  release. Empty on every single-domain client — the drop pass is then a structural no-op. */
+  private readonly pins = new Map<string, EchoFencePin>();
+  /** The §301 direction-A fence input: per room domain, the highest lmid the DAEMON-CARRIED
+   *  ledger rows have folded ({@link foldSystemFrames} step 2 — and ONLY that path: the room
+   *  socket's own lmid stream confirms long before the flush reaches the daemon, so it folds
+   *  into the shared {@link watermark} but never here, 301 §1.1). When this covers a pin's mid,
+   *  the same coherent release (or an earlier one) folded the flush data that carried it into
+   *  the daemon baseline — the fence. */
+  private readonly daemonCarriedLmid = new Map<string, number>();
+  /** The §301 §2.4 boot rule's inputs: the daemon boot ids this client has OBSERVED, in order
+   *  (id → ordinal), plus the current one. Boot ids are opaque — ordering is the client's own
+   *  observation ({@link OptimisticSource.onBootId} on the daemon gate). Direction-B pins stamp
+   *  the current boot; a room advertising a LATER-observed boot proves absorption (its
+   *  re-snapshot came from a daemon state that durably includes the confirmed write). */
+  private readonly daemonBootOrdinals = new Map<string, number>();
+  private daemonBootId: string | undefined;
+  /** The per-read provenance probe `invoke` hands `trackingTx` when recording is armed (H-ii,
+   *  §3.2 #3): the engine's `provenanceOf` — the VISIBLE overlay-first winner for the row's pk,
+   *  read from LIVE pre-commit state (an open txn's staged writes are not consulted; H-i). Gated
+   *  on PER-TABLE {@link promotedTables} membership — the cheapest existing signal, and the
+   *  correct one: provenance is an ENGINE-merge question, not a channel question ({@link gates}
+   *  can hold a connected-but-unpromoted room feed, and the oracle harness promotes with no gate),
+   *  and a never-promoted (Collapsed) table is daemon-owned by construction. So a pure
+   *  single-domain app pays ZERO wasm calls per recorded read; the recorded `source` is then
+   *  `undefined`, which is also correct — everything is daemon-owned (see {@link ReadRecord}). */
+  private readonly readProvenance = (table: string, row: WireValue[]): string | undefined =>
+    this.promotedTables.has(table) ? this.local.provenanceOf(table, row) : undefined;
+
+  // --- the §4 lifecycle SYSTEM-STREAM plane (Slice I-iii) --------------------------------
+  /** System retains by source qid ({@link retainSystemQuery}): a subscription with NO store view
+   *  and NO user-visible table — its frames buffer on its gate exactly like {@link LMID_QID}'s and
+   *  fold at RELEASE time ({@link foldSystemFrames}), never entering the sync layer or the local
+   *  engine. The spec names which system table the qid serves and the scope/doc it was minted for
+   *  (the fold's row filter). Empty on every non-lifecycle client — every partition below is then
+   *  a structural no-op and the release path is byte-identical to before. */
+  private readonly systemQids = new Map<QueryId, SystemStreamSpec>();
+  /** The §4.2 fence state: room doc → highest `flush_seq` delivered through the daemon plane
+   *  (monotone max-fold; a remove never regresses it). Slice I-v's ghost-drop consumer — I-iii
+   *  only maintains + exposes it (`__inspectDomains().lifecycle`). */
+  private readonly roomWatermarks = new Map<string, number>();
+  /** The §4.1 occupancy state: scope → (client_id → expires_at) from the doorbell stream. Slice
+   *  I-iv's doorbell consumer (the 1→2 re-lease reaction) — I-iii only maintains + exposes it.
+   *  A snapshot REPLACES the scope's map (authoritative re-hydrate); a batch folds add/edit/remove
+   *  incrementally (the age-out sweep's deletes arrive as removes). */
+  private readonly scopeSessions = new Map<string, Map<string, number>>();
+  /** The I-iv doorbell event sink ({@link onScopeSessions}) — fired once per scope a release's
+   *  scope-session fold touched, AFTER the whole release applied. Default no-op: a client that
+   *  never registers (no lifecycle plane) pays nothing. */
+  private scopeSessionsHandler: (event: ScopeSessionsEvent) => void = () => {};
+  /** Deferred old-channel row GC for in-flight upgrade retargets ({@link retargetRemoteQuery}):
+   *  sub sourceQid → the channel it left. The rows the OLD gate's sync holds for the qid stay
+   *  visible (merge: daemon tier) until the sub's first snapshot RELEASES on its new room channel
+   *  ({@link flushRetargetGc}) — dropping them at retarget time would emit net removes ahead of
+   *  the room's re-adds, the flicker the two-phase cutover exists to avoid. Doubles as the
+   *  wrong-channel GRACE window in {@link onFrame}: a frame already in flight from the old
+   *  channel when the sub moved is stale, not a wiring bug. Empty on every non-upgrade client —
+   *  every consultation below is then a structural no-op. */
+  private readonly pendingRetargetGc = new Map<QueryId, string>();
+  /** The §4.2 GHOSTS (Slice I-v): demoted room sources awaiting their watermark fence, by
+   *  sourceKey. Written only by {@link demoteRoomSource}; evaluated after every release
+   *  ({@link evaluateGhosts}) and dropped by {@link dropGhost} once the fence clears with no
+   *  sent room-domain pending left. Empty on every non-downgrade client — the per-release
+   *  evaluation is then a structural no-op. */
+  private readonly ghosts = new Map<string, RoomGhost>();
+  /** The I-v stuck-downgrade surface ({@link onDowngradeStuck}) — fired AT MOST ONCE per ghost
+   *  when its fence is satisfied but sent room-domain mids remain unresolved (§7.5: they retire
+   *  only through outcome resolution; the ghost holds rather than inventing a timeout-retire).
+   *  Default no-op. */
+  private downgradeStuckHandler: (event: DowngradeStuckEvent) => void = () => {};
 
   private readonly asts = new Map<QueryId, Ast>();
   /** Per query: the base tables its result can draw from (from the AST tree). */
@@ -396,16 +918,20 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     this.local = new WasmBackend(schema);
     this.local.onEvent((qid, ev) => {
       // Stamp a newly-hydrating query's reconcile batch as a catch-up (initial-hydration) delivery,
-      // so the Store phases it as a `snapshot` rather than narrating the whole first result set.
-      const stamped = ev.type === "batch" && this.catchUpQids?.has(qid) ? { ...ev, catchUp: true } : ev;
-      this.handler(qid, stamped);
+      // so the Store phases it as a `snapshot` rather than narrating the whole first result set. Record
+      // that we emitted a hydration batch for this qid, so `onProgress` knows which newly-hydrated qids
+      // still need an explicit empty catch-up (they folded nothing — see {@link catchUpEmitted}).
+      const stamp = ev.type === "batch" && this.catchUpQids?.has(qid) === true;
+      if (stamp) this.catchUpEmitted?.add(qid);
+      this.handler(qid, stamp ? { ...ev, catchUp: true } : ev);
     });
     // Forward the local engine's commit brackets up to the Store (cross-view-atomic notification):
     // every data delta this backend emits comes from `this.local`, so its commit boundaries are ours.
     this.local.onCommitBoundary((phase) => this.boundaryHandler(phase));
     this.colCounts = colCountsFromSchema(schema);
     this.colIndex = colIndexFromSchema(schema);
-    this.sync = new NormalizedSync(pkColsFromSchema(schema), this.colCounts);
+    this.pkCols = pkColsFromSchema(schema);
+    this.sync = new NormalizedSync(this.pkCols, this.colCounts);
     this.specs = tableSpecsFromSchema(schema);
     this.localTables = localTableNames(schema);
     this.source = source;
@@ -414,23 +940,83 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     this.user = opts.user ?? (() => "");
     this.bufferCap = opts.bufferCap ?? 1024;
     this.clock = opts.clock ?? REAL_CLOCK;
-    // Validate each server hello against our OWN typed schema → reject a schema skew
-    // (CRIT#4). The reserved lmid table is part of the expected set so the system
-    // query's hello passes. Synthetic agg tables join the set as queries register them.
-    this.clientTablesBase = [...normalizedTableSchemas(schema), CLIENT_MUTATIONS_SCHEMA];
-    this.source.expectClientSchema?.(this.clientTablesBase);
-    this.source.onNormalized((qid, ev) => this.onNormalized(qid, ev));
-    this.source.onProgress((frame) => this.onProgress(frame));
-    this.source.onRestart?.(() => this.resetForRestart());
-    // The lmid system query (lmid-as-data): our confirmations arrive on this stream,
-    // cv-tagged, released by the same cvMin as the data they belong to. The server
-    // derives the identity from the connection; args are advisory.
-    this.source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
+    // No policy configured ⇒ every route DERIVES (H-iii §3). With no room gate connected the
+    // derivation short-circuits to "daemon", so a single-domain app is byte-for-byte as before.
+    this.domainPolicy = opts.domainPolicy ?? (() => undefined);
+    this.rejectedHandler = opts.onRejected ?? (() => {});
+    // The reserved lmid table + (I-iii) the four lifecycle system tables join the expected set so
+    // a system subscription's hello passes CRIT#4 validation. Extra CLIENT-side entries are inert
+    // for every other server hello (validation only checks tables a server advertises), so a
+    // client that never receives a lifecycle block is byte-identical.
+    this.clientTablesBase = [...normalizedTableSchemas(schema), CLIENT_MUTATIONS_SCHEMA, ...LIFECYCLE_TABLE_SCHEMAS];
+    // The daemon is the always-present channel: its gate is attached at construction, and its
+    // per-source refcount space IS `this.sync` (the agg overlay reads it directly). A room
+    // channel attaches through the same seam later (§5.1; Slice G).
+    this.daemonGate = this.attachGate("daemon", source, this.sync);
+  }
+
+  /** Wire one authority channel into its own coherence gate (§5.1): every frame the channel
+   *  delivers buffers on THIS gate's cv timeline, its progress frames release THIS buffer, its
+   *  restart resets THIS gate alone, and its reserved lmid stream folds into `watermark[key]`.
+   *  Validates each server hello against our OWN typed schema → reject a schema skew (CRIT#4);
+   *  the reserved lmid table is part of the expected set so the system query's hello passes, and
+   *  synthetic agg tables join the set as queries register them. */
+  private attachGate(key: string, source: OptimisticSource, sync: NormalizedSync): SourceGate {
+    const gate: SourceGate = { key, source, sync, buffer: [], nextSeq: 0, appliedCv: 0 };
+    this.gates.set(key, gate);
+    source.expectClientSchema?.([...this.clientTablesBase, ...this.synthetic.values()]);
+    source.onNormalized((qid, ev) => this.onFrame(gate, qid, ev));
+    source.onProgress((frame) => this.onGateProgress(gate, frame));
+    source.onRestart?.(() => this.resetGate(gate));
+    // §301 §2.4: the DAEMON channel's observed boot-id stream seeds the client-local boot
+    // ordinals the direction-B fence's boot rule compares against (boot ids are opaque; order is
+    // the client's own observation). Only the daemon gate's boots matter — a room's advertised
+    // `upstreamBoot` names a DAEMON boot, and room-channel incarnations are handled by
+    // `resetGate`. Optional: an in-process source never reports one.
+    if (key === "daemon") source.onBootId?.((bootId) => this.observeDaemonBoot(bootId));
+    // The deopt handshake's client half (H-v §3.3): the channel's `mutationOutcome` frames arrive
+    // as `(domain = gate.key, frame)`. OUT-OF-BAND — the source dispatches on arrival and this
+    // handler runs immediately, NEVER behind the gate's cv buffer: a deopt must migrate its entry
+    // BEFORE the buffered lmid release that would otherwise retire it as a success (and the §7.3
+    // hold-back trigger, keyed on `p.domain`, would park its staged writes the wrong way).
+    source.onMutationOutcome?.((frame) => this.handleMutationOutcome(gate.key, frame));
+    // §7.5 rule 3 (H-v): a re-established session re-sends this DOMAIN's unconfirmed pending
+    // envelopes with their ORIGINAL mids — the authority's own ledger dedups (an applied mid is
+    // silent; a non-applied one is re-answered from the recorded-outcome map into the handler
+    // above). This is the deopt crash-window closer: a frame lost with its socket is re-earned.
+    source.onResync?.(() => this.resendPending(gate.key));
+    // The lmid system query (lmid-as-data): confirmations arrive on this channel's stream,
+    // cv-tagged, released by the same cvMin as the data they belong to. The server derives
+    // the identity from the connection; args are advisory. Qid 0 is reserved PER CHANNEL —
+    // it never collides with Store-dealt qids and never enters the sync layer.
+    source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
+    return gate;
+  }
+
+  /** Attach a SECOND authority channel (§5.1) — the seam Slice G's room upgrade calls with the
+   *  ws-backed room feed. Rooms speak the daemon protocol verbatim (§2.4: the client cannot tell
+   *  a room from the daemon), so the argument is a full {@link OptimisticSource} — exactly what
+   *  `@rindle/remote` builds from `{roomUrl, leaseToken}`. The channel buffers/releases on its
+   *  own cv timeline (an independent §5.1 gate: coherent within, eventual across) and its
+   *  reserved lmid stream folds into `watermark[sourceKey]` — so `sourceKey` must equal the
+   *  `domainPolicy` name for the mutations this authority confirms. The converse is NOT required:
+   *  a domain may exist with no connected gate (`__testRelease` drives confirms gate-less); the
+   *  live production path stays daemon-only until G calls this. */
+  connectSource(sourceKey: string, source: OptimisticSource): void {
+    if (this.gates.has(sourceKey)) {
+      throw new Error(`optimistic backend: source ${sourceKey} is already connected`);
+    }
+    this.attachGate(sourceKey, source, new NormalizedSync(this.pkCols, this.colCounts));
   }
 
   // --- the Backend seam ---------------------------------------------------------
 
-  registerQuery(qid: QueryId, ast: Ast, remote?: RemoteQuery): void {
+  /** `channel` (G-iii registration-time routing) names the authority channel the remote sub
+   *  registers on — a `connectSource`d gate key; default `"daemon"` (every existing caller is
+   *  byte-identical). Slice G-v threads the lease's `realtime.sourceKey` here. Validated FIRST
+   *  (like the E3 check below): a bad channel must throw before any per-query state is recorded. */
+  registerQuery(qid: QueryId, ast: Ast, remote?: RemoteQuery, channel?: string): void {
+    if (remote) this.requireGate(channel ?? "daemon");
     // queryTables is derived from the ORIGINAL ast — its `count(comments)` subquery names
     // `comment`, so an optimistic comment mutation flips this query to `unknown` (§6). The
     // local engine, by contrast, runs the REWRITTEN ast (reads the synthetic `__agg_*`).
@@ -465,7 +1051,7 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     if (remote) {
       // A remote query is `unknown` until its first server snapshot lands (hydration); retainRemote
       // attaches it to the sub and sets the lifecycle against the sub's hydration state.
-      this.retainRemote(qid, remote);
+      this.retainRemote(qid, remote, qid, channel);
     } else {
       // No server stream (a purely local AST view — or the local half of a split retain whose
       // remote attaches separately via `retainRemoteQuery`): local data is synchronous, so it is
@@ -532,9 +1118,18 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
 
   unregisterQuery(qid: QueryId): void {
     const remoteQid = this.releaseRemote(qid);
-    if (remoteQid !== undefined) this.buffer = this.buffer.filter((f) => f.qid !== remoteQid);
-    // GC: rows this remote footprint SOLELY referenced fall to refcount 0 → net removes.
-    const gc = remoteQid === undefined ? [] : this.sync.dropQuery(remoteQid);
+    // GC: rows this remote footprint SOLELY referenced fall to refcount 0 → net removes. A qid
+    // lives on ONE channel, so at most one gate's dropQuery is non-empty (dropQuery of an
+    // unknown qid returns []) — but sweep every gate so this needs no ownership lookup.
+    const gcs: [string, Mutation[]][] = [];
+    if (remoteQid !== undefined) {
+      this.pendingRetargetGc.delete(remoteQid); // the sweep below covers a mid-retarget teardown
+      for (const gate of this.gates.values()) {
+        gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
+        const gc = gate.sync.dropQuery(remoteQid);
+        if (gc.length) gcs.push([gate.key, gc]);
+      }
+    }
     // Tear down the local pipeline+view first so the reconcile cycle below skips it.
     this.local.unregisterQuery(qid);
     // The GC removals must leave BOTH head AND the engine's `sync` baseline. A plain
@@ -542,8 +1137,9 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     // optimistic REMOVE: the next release's rewind diffs head against sync+D and RESURRECTS
     // them, GC never frees anything, and a later query is served the stale/deleted row
     // forever (CRIT#2). Deliver them as a coherent SERVER delta instead — the same
-    // sync-moving boundary `onProgress` uses — so head and sync both drop the rows.
-    if (gc.length) this.runReconcileCycle(gc);
+    // sync-moving boundary the release gate uses — so head and sync both drop the rows,
+    // against the SOURCE whose baseline held them.
+    for (const [key, gc] of gcs) this.runReconcileCycle(key, gc);
     // The local pipeline is gone (no live conn) and the remote footprint's `__agg` rows were
     // GC'd above, so any synthetic table this was the last reader of can now be freed (§4).
     this.releaseSyntheticTables(qid);
@@ -555,9 +1151,14 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     // Store counter — re-materialize gets a fresh id, never this one again), so drop it on teardown.
   }
 
-  retainRemoteQuery(qid: QueryId, remote: RemoteQuery, localQueryId?: QueryId, ast?: Ast): void {
+  /** `channel` as in {@link registerQuery} (G-iii): the gate the remote sub registers on; default
+   *  `"daemon"`. This is the split-retain seam G-v's resolve-then-register drives — resolve the
+   *  lease, learn `realtime.sourceKey`, `connectSource` it, then retain the query on that channel.
+   *  Validated FIRST so a bad channel throws before any synthetic-table refcount moves. */
+  retainRemoteQuery(qid: QueryId, remote: RemoteQuery, localQueryId?: QueryId, ast?: Ast, channel?: string): void {
+    this.requireGate(channel ?? "daemon");
     if (ast) this.ensureSyntheticTables(qid, ast);
-    this.retainRemote(qid, remote, localQueryId);
+    this.retainRemote(qid, remote, localQueryId, channel);
   }
 
   releaseRemoteQuery(qid: QueryId): void {
@@ -568,9 +1169,305 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
       this.hydrated.delete(qid);
     }
     if (remoteQid === undefined) return;
-    this.buffer = this.buffer.filter((f) => f.qid !== remoteQid);
-    const gc = this.sync.dropQuery(remoteQid);
-    if (gc.length) this.runReconcileCycle(gc);
+    // A mid-retarget release: the every-gate sweep below IS the deferred old-channel GC
+    // (dropQuery hits the old gate's sync too), so retire the pending record — and its
+    // wrong-channel grace — with it.
+    this.pendingRetargetGc.delete(remoteQid);
+    // Per-gate sweep, like `unregisterQuery`: at most one gate owned this qid's frames/rows.
+    for (const gate of this.gates.values()) {
+      gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
+      const gc = gate.sync.dropQuery(remoteQid);
+      if (gc.length) this.runReconcileCycle(gate.key, gc);
+    }
+  }
+
+  /** The Slice I-iv upgrade retarget (§4.1 "Retarget" / the doorbell reaction): move a LIVE
+   *  (name, args) sub — every retain of it and every local view it feeds, wholesale — from the
+   *  channel it lives on onto `sourceKey`'s (already-`connectSource`d, already-promoted) room
+   *  channel, WITHOUT the view ever dropping its rows. Returns the sub's wire `sourceQid` (the
+   *  identity the client's renewal loop re-subscribes with).
+   *
+   *  Why a dedicated primitive: the one-channel-per-(name,args) invariant ({@link retainRemote}'s
+   *  loud throw) is correct — a sub's frames must never split across two cv timelines — so the
+   *  upgrade cannot simply retain a second sub on the room and release the daemon one; and the
+   *  naive release-then-retain order GCs the daemon sync's rows synchronously (net removes emit,
+   *  the view flashes empty) a full ws round trip before the room's seq-0 snapshot refills it.
+   *  The cutover is therefore TWO-PHASE around the room's first release:
+   *
+   *   1. NOW (here): unsubscribe the old channel's wire sub, sweep its still-buffered frames for
+   *      this qid (their cv timeline continues without the sub — the hello-supersession
+   *      precedent), flip `sub.channel`, re-arm `sub.hydrated` (the room's own snapshot is the
+   *      cutover point), and register on the room source (its resolver presents the handed
+   *      roomToken). The old gate's SYNC rows are deliberately NOT dropped: they keep the view's
+   *      rows visible through the window (merge: the daemon-tier holder). Local views keep their
+   *      `hydrated` membership — the view stays `complete` on its authoritative daemon rows.
+   *   2. AT THE ROOM'S FIRST RELEASED SNAPSHOT ({@link flushRetargetGc}): the room source now
+   *      holds the footprint rows (folded via `serverBatchBegin(sourceKey)` — value-equal rows
+   *      re-hydrate as a net-zero diff, RT §3.4 per channel), so the deferred
+   *      `dropQuery`+reconcile on the OLD gate flips each pk's winner daemon→room value-equal:
+   *      net-zero again. No emission carries a disappearance at any point.
+   *
+   *  Idempotent per target channel: a sub already on `sourceKey` returns immediately (the
+   *  double-doorbell / re-entrancy guard — one retarget per (query, sourceKey), mirroring
+   *  {@link promoteRoomTable}'s caller-side per-(sourceKey, table) idempotence). Validates before
+   *  mutating: a throw here leaves the sub fully daemon-attached (the client's fail-open). */
+  retargetRemoteQuery(remote: RemoteQuery, sourceKey: string): QueryId {
+    const newGate = this.requireGate(sourceKey); // throw loudly BEFORE any sub state moves
+    const key = remoteKey(remote);
+    const sub = this.remoteSubs.get(key);
+    if (!sub) {
+      throw new Error(
+        `optimistic backend: no live sub for query "${remote.name}" — nothing to retarget`,
+      );
+    }
+    if (sub.channel === sourceKey) return sub.sourceQid; // already there — idempotent
+    const oldGate = this.gates.get(sub.channel) ?? this.daemonGate;
+    oldGate.source.unregisterQuery(sub.sourceQid);
+    oldGate.buffer = oldGate.buffer.filter((f) => f.qid !== sub.sourceQid);
+    this.pendingRetargetGc.set(sub.sourceQid, sub.channel);
+    sub.channel = sourceKey;
+    sub.hydrated = false;
+    newGate.source.registerQuery(sub.sourceQid, remote);
+    return sub.sourceQid;
+  }
+
+  /** Phase 2 of {@link retargetRemoteQuery}, run at the end of every gate release: once a
+   *  retargeted sub's first snapshot has RELEASED on its new channel (`sub.hydrated` re-armed at
+   *  retarget, re-set by {@link markSubHydrated} inside this very release), drop the qid's rows
+   *  from the OLD gate's sync and reconcile them out — after the room's rows are already applied,
+   *  so the winner flip is value-equal (net-zero; see the phase table above). A sub torn down
+   *  mid-window was already swept by `releaseRemoteQuery`/`unregisterQuery` (which delete the
+   *  record); a vanished record here is pruned defensively. */
+  private flushRetargetGc(gate: SourceGate): void {
+    if (this.pendingRetargetGc.size === 0) return; // every non-upgrade release: structural no-op
+    for (const [sourceQid, oldGateKey] of this.pendingRetargetGc) {
+      const key = this.sourceToRemote.get(sourceQid);
+      const sub = key !== undefined ? this.remoteSubs.get(key) : undefined;
+      if (!sub) {
+        this.pendingRetargetGc.delete(sourceQid);
+        continue;
+      }
+      if (sub.channel !== gate.key || !sub.hydrated) continue; // not this gate / not yet cut over
+      this.pendingRetargetGc.delete(sourceQid);
+      const oldGate = this.gates.get(oldGateKey);
+      if (!oldGate) continue;
+      const gc = oldGate.sync.dropQuery(sourceQid);
+      if (gc.length) this.runReconcileCycle(oldGateKey, gc);
+    }
+  }
+
+  // --- the §4.2 downgrade: demote → ghost → fence → drop (Slice I-v) ----------------------
+
+  /** The I-v downgrade orchestration primitive (§4.2/§7.4): retire room `sourceKey` behind the
+   *  watermark fence. The caller has ALREADY retargeted every live sub off the channel
+   *  ({@link retargetRemoteQuery} room→daemon — validated loudly below) and holds the fence from
+   *  the api-server's downgrade response (`finalFlushSeq` = the room's last COMMITTED flush seq;
+   *  `doc` keys the §4.2 watermark fold, {@link roomWatermarks}). Steps, in order:
+   *
+   *   1. **De-candidacy NOW**: the sourceKey's {@link roomRouting} entries are removed, so
+   *      {@link deriveDomain} stops proposing the room (zero candidates ⇒ `"daemon"`). Unsent
+   *      pending (`mid === null`) re-routes for free — a fold's flush re-derives from the live
+   *      candidate set (§7.5 rule 1). The engine's frozen scope still ANSWERS (`writableMatches`
+   *      / `provenanceOf` — freezing gates serving, not the scope definition); routing is
+   *      TS-gated here.
+   *   2. **Freeze** the WRITABLE promoted tables (`freezeSource`): the room slice becomes the
+   *      §4.2 ghost — wins-if-present in the merge (D4), so its rows (at-or-ahead of the daemon
+   *      until the flush echoes) stay visible while the slice accepts nothing. Context tables
+   *      (`writable: false`) are deliberately NOT frozen: the daemon is authoritative for them
+   *      LIVE (§5.2's context tier) and freezing would invert that, pinning a possibly-BEHIND
+   *      relayed copy over fresher daemon rows; unfrozen they keep exactly the live tiering.
+   *   3. **Disconnect** the channel ({@link disconnectSource}): handlers detached, gate + buffer
+   *      dropped. `nextMid`/`watermark`/processed-outcomes for the domain are KEPT FOREVER (§7.1:
+   *      an assigned mid pins its domain; a later re-upgrade of the same doc continues the
+   *      sequence — {@link connectSource} attaches a fresh gate and the lmid snapshot max-folds
+   *      into the surviving watermark). Disconnecting BEFORE the daemon sub's first release is
+   *      load-bearing: it makes {@link flushRetargetGc}'s deferred old-channel GC a no-op (gate
+   *      gone ⇒ record deleted, nothing dropped) — running that GC would rewind the room slice's
+   *      rows at daemon hydration, i.e. BEFORE the fence, surfacing a lagging follower's stale
+   *      images (the exact regression §4.2 exists to prevent). The ghost's rows leave only
+   *      through {@link dropGhost}'s `removeRoomSource`, value-equal under the fence.
+   *   4. **Ghost + first evaluation**: the record joins {@link ghosts} and is evaluated once
+   *      immediately — `finalFlushSeq === 0` (a never-flushed room) with no room-domain pending
+   *      drops on the spot, the single-daemon first-frame case.
+   *
+   *  In-flight discipline (§7.5): entries with `mid !== null` on `sourceKey` stay PINNED (rule
+   *  2 — never re-route a sent mutation); their resolution arrives via the daemon-carried
+   *  ledger+outcome folds (I-iii) and blocks the drop until then. Idempotent per sourceKey (a
+   *  second labeled query sharing the room demotes into the existing ghost). */
+  demoteRoomSource(sourceKey: string, doc: string, finalFlushSeq: number): void {
+    if (sourceKey === "daemon") {
+      throw new Error("optimistic backend: the daemon source cannot be demoted");
+    }
+    if (this.ghosts.has(sourceKey)) return; // idempotent — one ghost per source
+    // Validate FIRST (nothing mutated yet): a live sub still on the channel would silently
+    // starve once the gate detaches — the caller must retarget every sub off the room first.
+    for (const sub of this.remoteSubs.values()) {
+      if (sub.channel === sourceKey) {
+        throw new Error(
+          `optimistic backend: cannot demote ${JSON.stringify(sourceKey)} — query "${sub.remote.name}" is still retained on it (retarget it to the daemon first)`,
+        );
+      }
+    }
+    const routing = this.roomRouting.get(sourceKey);
+    const tables = routing ? [...routing.keys()] : [];
+    const writable = routing ? tables.filter((t) => routing.get(t)!.writable) : [];
+    this.roomRouting.delete(sourceKey); // (1) de-candidacy
+    for (const table of writable) this.local.freezeSource(table, sourceKey); // (2) the ghost
+    this.disconnectSource(sourceKey); // (3) the channel
+    this.ghosts.set(sourceKey, { doc, finalFlushSeq, tables, stuckReported: false }); // (4)
+    this.evaluateGhosts();
+  }
+
+  /** Detach one connected room channel (Slice I-v step 3): the source's handlers are replaced
+   *  with no-ops (the {@link OptimisticSource} handler seam is single-registration, so this IS
+   *  the detach — a late frame from a dying socket can no longer touch any bookkeeping), its
+   *  reserved lmid sub is unregistered, and the gate — buffer, per-source sync, cv watermark —
+   *  is dropped from {@link gates}. The DOMAIN state deliberately survives forever:
+   *  `nextMid[sourceKey]`, `watermark[sourceKey]`, and the processed-outcome set are untouched
+   *  (§7.1 — an assigned mid pins its domain; a re-upgrade must continue, never restart, the mid
+   *  sequence; {@link connectSource} then attaches a fresh gate whose lmid snapshot max-folds
+   *  into the surviving watermark via {@link foldConfirm}). Closing the underlying transport is
+   *  the caller's job. Idempotent (a missing gate is a no-op). */
+  disconnectSource(sourceKey: string): void {
+    if (sourceKey === "daemon") {
+      throw new Error("optimistic backend: the daemon source cannot be disconnected");
+    }
+    const gate = this.gates.get(sourceKey);
+    if (!gate) return;
+    this.gates.delete(sourceKey);
+    gate.source.onNormalized(() => {});
+    gate.source.onProgress(() => {});
+    gate.source.onRestart?.(() => {});
+    gate.source.onMutationOutcome?.(() => {});
+    gate.source.onResync?.(() => {});
+    gate.source.unregisterQuery(LMID_QID);
+  }
+
+  /** Register the I-v stuck-downgrade sink — see {@link DowngradeStuckEvent}. One handler (a
+   *  later registration replaces it, the {@link onScopeSessions} convention); client.ts maps it
+   *  onto the loud anomaly surface. */
+  onDowngradeStuck(handler: (event: DowngradeStuckEvent) => void): void {
+    this.downgradeStuckHandler = handler;
+  }
+
+  /** The I-v ghost-drop watcher (§4.2), run after every applied release ({@link applyRelease} —
+   *  the seam where {@link roomWatermarks} has just folded and the confirm-drop has just run) and
+   *  once at demote time. For each ghost: the fence must be satisfied
+   *  (`roomWatermarks[doc] ≥ finalFlushSeq`; 0 is trivially satisfied) AND no SENT room-domain
+   *  pending may remain (§7.5 — such entries resolve only through the daemon-carried
+   *  outcome/ledger folds; an entry that never reached the room is undecidable, so the ghost
+   *  HOLDS and the stuck event fires exactly once, naming the mids). Both satisfied ⇒
+   *  {@link dropGhost}. */
+  private evaluateGhosts(): void {
+    if (this.ghosts.size === 0) return; // every non-downgrade release: structural no-op
+    for (const [sourceKey, ghost] of [...this.ghosts]) {
+      if ((this.roomWatermarks.get(ghost.doc) ?? 0) < ghost.finalFlushSeq) continue; // fence holds
+      const stuck = this.pendingMutations.filter((p) => p.domain === sourceKey && p.mid !== null);
+      if (stuck.length > 0) {
+        if (!ghost.stuckReported) {
+          ghost.stuckReported = true;
+          this.downgradeStuckHandler({ sourceKey, doc: ghost.doc, mids: stuck.map((p) => p.mid as number) });
+        }
+        continue; // hold — never a timeout-retire (§7.5 rule 2)
+      }
+      this.dropGhost(sourceKey, ghost);
+    }
+  }
+
+  /** Drop one cleared ghost (§4.2 end state): detach every promoted table's room source (D2
+   *  stay-merged — `removeRoomSource` reconciles each held pk to daemon-or-vanish, value-equal
+   *  under the fence, so visually a no-op), release the {@link promotedTables} record for tables
+   *  no OTHER room/ghost still holds, then run ONE daemon reconcile so entries whose writes had
+   *  staged onto the ghost slice re-invoke and re-stage by provenance onto the daemon slice (the
+   *  removal took their staged copies with the tree; provenance now answers daemon). The whole
+   *  drop runs under one commit boundary so the removal's compensating deltas and the re-staged
+   *  predictions notify as ONE step. After this, a FUTURE upgrade of the same doc promotes
+   *  again from scratch — the round trip is pinned by the §8.5 lanes. */
+  private dropGhost(sourceKey: string, ghost: RoomGhost): void {
+    this.ghosts.delete(sourceKey);
+    // Re-stage eligibility FIRST: a pending entry staged (only) on the ghost slice must join the
+    // daemon reconcile below (the cycle filter is `touchedSources.has(sourceKey)`) — union, never
+    // shrink, the §5.3 rule.
+    let restage = false;
+    for (const p of this.pendingMutations) {
+      if (p.touchedSources.has(sourceKey)) {
+        p.touchedSources.add("daemon");
+        restage = true;
+      }
+    }
+    this.inOneCommit(() => {
+      for (const table of ghost.tables) this.local.removeRoomSource(table, sourceKey);
+      for (const table of ghost.tables) {
+        let held = false;
+        for (const byTable of this.roomRouting.values()) if (byTable.has(table)) held = true;
+        for (const g of this.ghosts.values()) if (g.tables.includes(table)) held = true;
+        if (!held) this.promotedTables.delete(table);
+      }
+      // One daemon reconcile replays the re-staged entries onto the daemon slice. Run whenever
+      // any pending exists: the removal above may have taken a staged write with the tree even
+      // when `touchedSources` never recorded the ghost (defensive; an empty-pending drop skips).
+      if (restage || this.pendingMutations.length > 0) this.runReconcileCycle("daemon", []);
+    });
+    this.refreshPending(); // the reconcile may have dropped a throwing re-invocation
+  }
+
+  // --- the §4 lifecycle SYSTEM-STREAM retains (Slice I-iii) ------------------------------
+
+  /** Retain one minted SYSTEM subscription (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §4, Slice
+   *  I-iii): a wire sub with NO store view and NO user-visible table. Registered through the same
+   *  {@link RemoteSub} bookkeeping as any remote retain — so qid→channel ownership, the overflow
+   *  re-subscribe, and refcounted release all work unchanged — but with an EMPTY `localQids` set
+   *  (no hydration/resultType coupling) and a {@link systemQids} record telling the release path
+   *  which system table this qid's frames carry (`spec.table`) and which scope/doc it was minted
+   *  for (the fold's row filter). Its frames then buffer on the channel's gate exactly like
+   *  {@link LMID_QID}'s and fold at RELEASE time in {@link foldSystemFrames} — riding the SAME
+   *  buffered cv path as the data they co-committed with (fence coherence: an out-of-band
+   *  shortcut would break I-ii's co-commit ordering guarantee).
+   *
+   *  `channel` defaults to `"daemon"` — the system tables live in the DAEMON store (that is the
+   *  point: outcome/ledger/watermark rows must be readable with no room socket alive, §7.1
+   *  "load-bearing for §7.5"). Idempotence per (table, scope/doc) is the CALLER's job (client.ts
+   *  keys its retains on exactly that); a duplicate retain of the SAME remote identity refcounts
+   *  like any sub. */
+  retainSystemQuery(retainQid: QueryId, remote: RemoteQuery, spec: SystemStreamSpec, channel = "daemon"): void {
+    const gate = this.requireGate(channel); // throw loudly BEFORE any sub state moves
+    const key = remoteKey(remote);
+    let sub = this.remoteSubs.get(key);
+    if (sub) {
+      if (sub.channel !== channel) {
+        throw new Error(
+          `optimistic backend: system query "${remote.name}" is already retained on channel ${JSON.stringify(sub.channel)} — cannot retain it on ${JSON.stringify(channel)}`,
+        );
+      }
+      sub.refCount++;
+      this.localToRemote.set(retainQid, key);
+      this.remoteRetainToLocal.set(retainQid, undefined);
+      return;
+    }
+    // A fresh sub: deliberately NOT `retainRemote` — its `localQueryId` default would couple this
+    // retain's qid to the view-hydration machinery (`hydrated`/`resultType`), and a system stream
+    // has no view to hydrate.
+    sub = { sourceQid: retainQid, remote, refCount: 1, localQids: new Map(), hydrated: false, channel };
+    this.remoteSubs.set(key, sub);
+    this.sourceToRemote.set(retainQid, key);
+    this.localToRemote.set(retainQid, key);
+    this.remoteRetainToLocal.set(retainQid, undefined);
+    this.systemQids.set(retainQid, { ...spec });
+    gate.source.registerQuery(retainQid, remote);
+  }
+
+  /** Release a {@link retainSystemQuery} retain. Refcounted like any sub; the LAST release
+   *  unregisters from the owning channel, sweeps its buffered frames, and drops the
+   *  {@link systemQids} record. The folded lifecycle STATE (`roomWatermarks`/`scopeSessions`/
+   *  processed outcomes) deliberately survives — the fence is monotone truth about the store, not
+   *  about the subscription (a re-retained fence must not forget a cleared watermark). */
+  releaseSystemQuery(retainQid: QueryId): void {
+    const remoteQid = this.releaseRemote(retainQid);
+    if (remoteQid === undefined) return; // still refcounted (or unknown)
+    for (const gate of this.gates.values()) {
+      gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
+    }
+    this.systemQids.delete(remoteQid);
   }
 
   /** Raw CRUD has no optimistic story (§9 replaces it with named mutators). Register a
@@ -664,10 +1561,223 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     }
   }
 
+  /** Deal the next wire mid from `domain`'s ledger (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md
+   *  §7.1) and advance that counter. A domain absent from the map starts at 1. Per-domain, so a
+   *  client writing through room + daemon concurrently keeps two gapless, non-aliasing sequences.
+   *  The client-global `seq` is stamped in the same breath — the ONE cross-domain total order
+   *  (confirmation order is per-domain; replay order is client-global). Bundled here so no call
+   *  site can deal a mid without its seq. ONE caller discards the seq deliberately: the H-v deopt
+   *  flip ({@link handleMutationOutcome}) keeps the entry's ORIGINAL seq — its replay position —
+   *  and takes only the fresh mid (the dealSeq bump is harmless: seq consumers order, never
+   *  count). */
+  private dealMid(domain: string): { mid: number; seq: number } {
+    const mid = this.nextMid.get(domain) ?? 1;
+    this.nextMid.set(domain, mid + 1);
+    return { mid, seq: ++this.dealSeq };
+  }
+
+  // --- the §3 prove-or-slow-path ROUTER (H-iii) -----------------------------------
+  //
+  // RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §3: a mutation routes to room R iff every row its
+  // prediction run WROTE is provably inside R's writable scope and every read it RECORDED is
+  // provably covered by R's footprint — ANY unproven condition routes slow (the §0 asymmetry:
+  // mis-guessing "slow" costs one round-trip; mis-guessing "room" would commit divergent data).
+  // Failure is therefore SILENT "daemon" — never a throw, never a warning per call — plus the Q6
+  // per-reason counters ({@link RoutingInspect}).
+  //
+  // The proof evaluates against the ENGINE wherever the engine has an answer: `writableMatches`
+  // (the registered compiled writable scope — the same predicate the merge's winner tiering uses)
+  // and `provenanceOf` (the visible overlay-first winner). It runs AFTER the prediction committed,
+  // so the probes see the prediction's own staged effects — which only ever strengthens the
+  // conservative direction (a fresh pk reports "daemon"/undefined and neither disqualifies).
+  //
+  // ** THE ONE CLIENT-SIDE NON-ENGINE EVALUATOR — deliberately minimal (the TS evaluation
+  // caveat). ** Evaluating `footprintWhere` on a read's pk cells ({@link evalFootprintOnPk}) is
+  // the single place Slice H allows a non-engine evaluator, and it is restricted to STRICT cell
+  // equality only: `simple` `=` / `!=` between a pk column and a same-primitive-type non-null
+  // literal, composed under and/or (the empty AND is the vacuous-true exact-unconstrained-root
+  // emission and evaluates true). ANY other op or shape — LIKE, <, >=, IS, IN, null operands,
+  // cross-type comparisons, column-vs-column — is NOT EVALUABLE and fails to the daemon.
+  // Justification: a mis-evaluation here cannot commit divergence — the room GATE (H-iv) re-proves
+  // every write and absent read engine-side at commit and deopts, so a wrong client verdict only
+  // costs a wasted hop (route room → gate deopt) or a skipped optimization (route daemon); and
+  // restricting to strict equality on non-null, same-typed pk cells removes the entire
+  // null/collation/coercion divergence space between this evaluator and the engine's comparators.
+  // The gate remains the contract; this router is the optimization.
+  //
+  // ** H-v (SHIPPED — the router's missing recovery half). ** A derived (or pinned) room route
+  // whose gate DEOPTS (the H-iv-b `mutationOutcome {kind:"deopt"}` frame — the mid is burnt in
+  // the room ledger, no effects committed) is re-enqueued onto the daemon stream by
+  // {@link handleMutationOutcome}: the entry flips in place (fresh daemon mid, ORIGINAL seq,
+  // prediction applied throughout), or — already retired — re-invokes from the frame's echoed
+  // name/args pinned to the daemon. A reconnect re-sends unconfirmed mids so a frame lost with
+  // its socket is re-answered ({@link resendPending}). A wrong client verdict therefore costs
+  // exactly one room round-trip plus one burnt room-mid (§3.3), never a stranded prediction.
+
+  /** The route decision for one invocation (invoke, and again at fold flush): the explicit
+   *  `domainPolicy` is the OVERRIDE — a string pins that domain verbatim, no proof runs;
+   *  `undefined` (or no policy configured) derives per §3. */
+  private resolveDomain(name: string, args: unknown, writes: WriteSet, reads: ReadLog): string {
+    const pinned = this.domainPolicy(name, args);
+    if (pinned !== undefined) return pinned;
+    return this.deriveDomain(writes, reads);
+  }
+
+  /** §9.3: does this fold's write-set route into a room (vs the daemon)? Used ONLY to pick the
+   *  {@link FoldOptions.roomDebounceMs} cadence at a fold window's start. It probes
+   *  {@link resolveDomain} but RESTORES the Q6 routing diagnostics afterward — the authoritative
+   *  route and its single counter bump belong to the flush ({@link flushFold}), not to this
+   *  interval hint. A fold's reads are provably empty (the read-trap arms on that path), so the
+   *  write-set alone decides. */
+  private routesToRoom(name: string, args: unknown, writes: WriteSet): boolean {
+    const reasons = [...this.routingReasons];
+    const derived = [...this.routingDerived];
+    const domain = this.resolveDomain(name, args, writes, { reads: [], queries: [] });
+    this.routingReasons.clear();
+    for (const [k, v] of reasons) this.routingReasons.set(k, v);
+    this.routingDerived.clear();
+    for (const [k, v] of derived) this.routingDerived.set(k, v);
+    return domain !== "daemon";
+  }
+
+  /** Count one derivation failure ({@link RoutingInspect}). Returns `false` so the per-candidate
+   *  proof's call sites read `return this.failDerivation(...)`. */
+  private failDerivation(reason: RoutingFailureReason): false {
+    this.routingReasons.set(reason, (this.routingReasons.get(reason) ?? 0) + 1);
+    return false;
+  }
+
+  /** The §3 derivation. Candidates are the connected room gates with at least one promoted table
+   *  (a promoted table with no gate cannot confirm; a gate with no promoted table holds no data to
+   *  prove against). Zero candidates ⇒ `"daemon"` (the single-domain fast path). The proof runs
+   *  per candidate and EXACTLY ONE must survive — two rooms both proving routes slow (principled
+   *  disambiguation is a §9.2 multi-room NON-goal, deferred past Slice J; slow is always sound). */
+  private deriveDomain(writes: WriteSet, reads: ReadLog): string {
+    const candidates: string[] = [];
+    for (const key of this.gates.keys()) {
+      if (key === "daemon") continue;
+      if ((this.roomRouting.get(key)?.size ?? 0) > 0) candidates.push(key);
+    }
+    if (candidates.length === 0) {
+      this.failDerivation("no-candidates");
+      return "daemon";
+    }
+    // tx.query is not room-executable client-side: predicate containment (rindle-cover) is
+    // native-only BY DESIGN, so a declarative read fails the WHOLE derivation unconditionally.
+    // This is required, not conservative.
+    if (reads.queries.length > 0) {
+      this.failDerivation("tx-query");
+      return "daemon";
+    }
+    const proven = candidates.filter((room) => this.provesRoom(room, writes, reads));
+    if (proven.length === 1) {
+      const room = proven[0];
+      this.routingDerived.set(room, (this.routingDerived.get(room) ?? 0) + 1);
+      return room;
+    }
+    if (proven.length > 1) this.failDerivation("ambiguous");
+    return "daemon"; // zero survivors: each candidate already counted its own failure reason
+  }
+
+  /** One candidate room's §3 proof over the captured write-set + read-log. Every write must pass
+   *  ALL the write rules; every read must pass ONE of the read rules. First failure wins (and is
+   *  counted); order is deterministic (write-set map order, then read-log order). */
+  private provesRoom(room: string, writes: WriteSet, reads: ReadLog): boolean {
+    const specs = this.roomRouting.get(room);
+    // --- write rules: every WriteRecord passes ALL of #1–#4 -------------------------------
+    for (const [table, byPk] of writes) {
+      // #1: the table is promoted for R with a writable (predicate-kind) spec. A context table
+      // (`writable: none`), an un-promoted table, and a local table (unreachable — the mutator
+      // guard refuses local writes at stage time) all fail here.
+      const spec = specs?.get(table);
+      if (spec === undefined || !spec.writable) return this.failDerivation("write-unwritable-table");
+      const colIx = this.colIndex[table];
+      for (const rec of byPk.values()) {
+        const removeShape = rec.row === undefined;
+        // #2: the registered writable scope, evaluated BY THE ENGINE on the post-image for
+        // add/edit shapes and on the pre-image for removes (the row the room would delete). A
+        // remove record always carries its full-width pre-image (the H-ii capture contract);
+        // a violated contract fails closed rather than probing nothing.
+        const scopeRow = removeShape ? rec.oldRow : rec.row;
+        if (scopeRow === undefined || !this.local.writableMatches(table, room, scopeRow)) {
+          return this.failDerivation("write-scope-miss");
+        }
+        // #3: join-key no-change. An edit-shape (row + oldRow — the oldRow is the txn-entry base)
+        // must keep every joinKeyCols cell STRICTLY identical old-vs-new; an add-shape may SET
+        // them (it creates the correlation); removes are exempt. A join-key column missing from
+        // the schema is a spec bug — fail closed.
+        if (!removeShape && rec.oldRow !== undefined) {
+          for (const col of spec.joinKeyCols) {
+            const i = colIx?.get(col);
+            if (i === undefined || !identicalCell(rec.oldRow[i], rec.row![i])) {
+              return this.failDerivation("write-join-key-change");
+            }
+          }
+        }
+        // #4: provenance corroboration — the engine routes an Edit by its OLD row (H-i), so probe
+        // the pre-image for edit/remove shapes and the post-image for add-shapes. A winner naming
+        // a DIFFERENT room disqualifies; "daemon"/undefined does NOT (a thin slice, or a fresh pk
+        // — fresh pks stage to the daemon slice by the E2 decision, kept permanently: the
+        // room-side authoritative run is the committing execution either way).
+        const probeRow = rec.oldRow ?? rec.row;
+        if (probeRow !== undefined) {
+          const src = this.local.provenanceOf(table, probeRow);
+          if (src !== undefined && src !== "daemon" && src !== room) {
+            return this.failDerivation("write-cross-room-provenance");
+          }
+        }
+      }
+    }
+    // --- read rules: every ReadRecord passes ONE ------------------------------------------
+    // (tx.query already failed the whole derivation in deriveDomain — never reaches here.)
+    for (const r of reads.reads) {
+      // Self-read: the pk is in THIS invocation's write-set for that table — the write rules
+      // above already judged it (covers the keyed writers' probe-then-write shape). NOTE the
+      // read-log reflects the ORIGINAL invoke only (the pre-existing capture caveat).
+      if (writes.get(r.table)?.has(stableJson(r.pk))) continue;
+      if (r.source !== undefined) {
+        if (r.source === room) continue; // the room served the row — in-footprint by construction
+        if (r.source !== "daemon") return this.failDerivation("read-cross-room");
+      }
+      // Present-with-daemon/undefined source, or ABSENT (source is never recorded for those —
+      // including the un-promoted-table meaning of an absent key): the footprint-membership test
+      // on the PK ALONE. R's footprintWhere must exist, be key-decidable (every column it reads is
+      // a pk column), and evaluate TRUE on the read's pk cells:
+      //   present-daemon + TRUE  ⇒ the row is in the room's COMPLETE footprint ⇒ covered;
+      //   absent + TRUE          ⇒ absent-in-room = absent-in-truth ⇒ covered;
+      //   FALSE (either outcome) ⇒ fail — present-daemon-FALSE means the room lacks the row;
+      //     absent-FALSE is arguably provable (decidably-outside ⇒ the room never sees the pk)
+      //     but the room-side run would then read absent for a DIFFERENT reason than truth's —
+      //     stay CONSERVATIVE and fail;
+      //   no footprintWhere / not key-decidable / not evaluable ⇒ fail (see the evaluator caveat
+      //     on the router block comment).
+      const fw = specs?.get(r.table)?.footprintWhere;
+      if (fw === undefined) return this.failDerivation("read-no-footprint-where");
+      const tspec = this.specs[r.table];
+      const pkCols = tspec.primaryKey.map((i) => tspec.columns[i]);
+      if (!keyDecidable(fw, new Set(pkCols))) return this.failDerivation("read-not-key-decidable");
+      const pkCells = new Map<string, WireValue>(pkCols.map((c, j) => [c, r.pk[j]]));
+      const verdict = evalFootprintOnPk(fw, pkCells);
+      if (verdict === undefined) return this.failDerivation("read-not-evaluable");
+      if (!verdict) return this.failDerivation("read-outside-footprint");
+    }
+    return true;
+  }
+
   /** Run the named client mutator optimistically: the prediction applies to the live
    *  engine now (affected views update synchronously), `(mid, name, args)` joins the
    *  pending stack, and the envelope ships upstream. Returns the assigned `mid`. */
   invoke(name: string, args: unknown): number {
+    return this.invokeWith(name, args);
+  }
+
+  /** {@link invoke} with an optional PINNED confirming domain (H-v): the deopt handshake's
+   *  already-retired arm re-invokes the frame's echoed `(name, args)` as a FRESH invocation pinned
+   *  to `"daemon"` — an honest re-prediction on the current base, never derived (`pin` bypasses
+   *  {@link resolveDomain} entirely, so the router never runs and no Q6 counter moves). Every
+   *  other step is `invoke` verbatim: prediction now, capture, drainOverlapping, mid dealt from
+   *  the pinned domain's ledger, envelope on its channel. */
+  private invokeWith(name: string, args: unknown, pin?: string): number {
     const mutator = this.registry[name];
     if (!mutator) throw new Error(`unknown client mutator: ${name}`);
     // One commit boundary spans the prediction AND the `__agg`-head reconcile below, so their views
@@ -677,18 +1787,42 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
       // the staged write is discarded (the wasm txn is a clean no-op until commit) and the throw
       // propagates with NO mid consumed — a burnt mid is a permanent server-side gap that
       // silently refuses every later mutation from this client (#10).
-      const touched = new Set<string>();
+      const writes: WriteSet = new Map();
+      const reads: ReadLog = { reads: [], queries: [] };
       const ops: ChildOp[] = [];
-      this.local.writeWith((tx) => {
-        this.runMutator(mutator, trackingTx(tx, touched, this.specs, this.localTables, this.opCollector(ops)), args);
+      // Per-staged-write source keys (staged order), zipped with the `commitTracked` `sources[]`
+      // below to learn which physical source each pk routed onto (§5.3 filter + §7.3 hold-back).
+      const stagedKeys: string[] = [];
+      const sources = this.local.writeWith((tx) => {
+        this.runMutator(
+          mutator,
+          // `readProvenance` rides only with recording (H-ii §3.2 #3): the folded path (trap, no
+          // readLog) and the reconcile replay (no readLog) never probe — see trackingTx.
+          trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, reads, stagedKeys, this.readProvenance),
+          args,
+        );
       });
+      // `touched` is DERIVED, never separately populated (§3.2 #1) — see {@link WriteSet}.
+      const touched = new Set(writes.keys());
       // Flush-on-enqueue (§4.2): a fold whose tables overlap this write must take its mid NOW, BEFORE
       // this write does, so wire order == local-apply order for any pair that can observe each other
       // (a read-dependent write reading a folded cell sees the same value optimistically and on the
       // wire — no snap). Drained folds ship with smaller mids; this write's mid is dealt after.
       this.drainOverlapping(touched);
-      const mid = this.nextMid++;
-      this.pendingMutations.push({ mid, name, args, touched });
+      // The confirming stream (§7.1): its ledger deals the mid and its watermark alone retires the
+      // entry. THE §3 ROUTER RUNS HERE (H-iii) — after the prediction (write/read capture is
+      // complete, and the engine holds the committed prediction the probes read) and BEFORE the
+      // mid is dealt: an assigned mid pins its domain forever (§7.1) — a re-invocation never
+      // re-routes. An explicit `domainPolicy` string pins verbatim (no proof); an H-v deopt
+      // re-invocation pins via `pin` (see {@link invokeWith}) and the router never runs.
+      const domain = pin ?? this.resolveDomain(name, args, writes, reads);
+      const { mid, seq } = this.dealMid(domain);
+      // The write-source axes (§5.3): which physical source each write staged onto. All `"daemon"`
+      // in single-domain (Collapsed) — so the filter and hold-back below are inert on the live path.
+      const touchedSources = new Set(sources);
+      const writeSources = new Map<string, string>();
+      mergeWriteSources(writeSources, stagedKeys, sources);
+      this.pendingMutations.push({ mid, seq, name, args, domain, touched, writes, reads, touchedSources, writeSources });
       // The prediction stuck — fold its child ops into the optimistic agg delta and push it onto
       // the `__agg` head rows (§4). No reset here (this is the §1.3 trivial case, no rewind): the
       // delta accumulates on top of the prior pending set, and `reconcileAggHead` recomputes each
@@ -696,7 +1830,7 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
       for (const op of ops) this.overlay.observe(op);
       this.reconcileAggHead();
       this.refreshPending(); // §7.2: this write now touches its queries' pending axis (NOT ResultType).
-      void this.source.pushMutation({ clientID: this.clientID, mid, name, args });
+      void this.channelFor(domain).pushMutation({ clientID: this.clientID, mid, name, args });
       return mid;
     });
   }
@@ -714,12 +1848,15 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     return this.inOneCommit(() => {
       // Apply the prediction with the read trap armed (§5): a folded mutator that reads state to
       // compute its write is non-absorbing and refused. A throw discards the staged write (clean
-      // no-op) and consumes no mid — exactly `invoke`'s guarantee.
-      const touched = new Set<string>();
+      // no-op) and consumes no mid — exactly `invoke`'s guarantee. NO `readLog` here — the trap
+      // path stays byte-for-byte as it was; recording (§3.2 #2) never arms alongside the trap.
+      const writes: WriteSet = new Map();
       const ops: ChildOp[] = [];
+      const stagedKeys: string[] = [];
+      let sources: string[] = [];
       try {
-        this.local.writeWith((tx) => {
-          this.runMutator(mutator, trackingTx(tx, touched, this.specs, this.localTables, this.opCollector(ops), true), args);
+        sources = this.local.writeWith((tx) => {
+          this.runMutator(mutator, trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), true, undefined, stagedKeys), args);
         });
       } catch (e) {
         if (e instanceof FoldReadError) {
@@ -732,6 +1869,13 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
       for (const op of ops) this.overlay.observe(op);
       this.reconcileAggHead();
 
+      // `touched` is DERIVED, never separately populated (§3.2 #1) — see {@link WriteSet}.
+      const touched = new Set(writes.keys());
+      // The write-source axes (§5.3), like `touched`/`writes` — REPLACED wholesale on an in-place
+      // fold overwrite (the latest invocation supersedes, absorbing), initialized on a new entry.
+      const touchedSources = new Set(sources);
+      const writeSources = new Map<string, string>();
+      mergeWriteSources(writeSources, stagedKeys, sources);
       const now = this.clock.now();
       let f = this.folds.get(foldKey);
       if (f) {
@@ -740,10 +1884,24 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
         // only the LATEST args, which is what a rebase re-derives from and what the flush ships.
         f.entry.args = args;
         f.entry.touched = touched;
+        f.entry.writes = writes;
+        f.entry.touchedSources = touchedSources;
+        f.entry.writeSources = writeSources;
         f.args = args;
         this.clock.clearTimeout(f.timer);
       } else {
-        const entry: PendingMutation = { mid: null, name, args, touched };
+        // Provisional domain (§7.1): re-resolved from the final args/write-set at flush, when the
+        // mid is dealt. Never read before then — an un-flushed fold (`mid == null`) is
+        // unconditionally retained — so the full (counting) derivation deliberately does NOT run
+        // here (it would double-bump the Q6 counters for one logical route); the flush derives.
+        const domain = this.domainPolicy(name, args) ?? "daemon";
+        // §9.3: pick the window's cadence. Routing into a room ⇒ flush at roomDebounceMs so
+        // intermediates stream to the shared head; off the room, the caller's collapse debounce
+        // governs. The probe restores the Q6 diagnostics (the flush owns the authoritative bump).
+        const inRoom = opts.roomDebounceMs !== undefined && this.routesToRoom(name, args, writes);
+        const debounceMs = inRoom ? opts.roomDebounceMs! : opts.debounceMs ?? DEFAULT_FOLD_DEBOUNCE_MS;
+        const maxWaitMs = inRoom ? opts.roomDebounceMs! : opts.maxWaitMs;
+        const entry: PendingMutation = { mid: null, seq: null, name, args, domain, touched, writes, reads: { reads: [], queries: [] }, touchedSources, writeSources };
         this.pendingMutations.push(entry);
         let resolveMid!: (mid: number) => void;
         const midPromise = new Promise<number>((res) => (resolveMid = res));
@@ -752,8 +1910,8 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
           args,
           timer: undefined,
           firstAt: now,
-          debounceMs: opts.debounceMs ?? DEFAULT_FOLD_DEBOUNCE_MS,
-          maxWaitMs: opts.maxWaitMs,
+          debounceMs,
+          maxWaitMs,
           deferAcrossWrites: opts.deferAcrossWrites ?? false,
           midPromise,
           resolveMid,
@@ -793,12 +1951,175 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     if (!f) return;
     this.clock.clearTimeout(f.timer);
     this.folds.delete(foldKey);
-    const mid = this.nextMid++;
+    // Resolve the confirming stream from the FINAL args (§7.1) and deal the mid from that domain's
+    // ledger — SEND order, never reserved, so gapless within the domain. Under H-iii derivation
+    // this RE-DERIVES from the entry's LATEST write-set (each in-place fold overwrite replaced it,
+    // so it reflects the final absorbed value): same §3 rules minus reads — a fold's read-set is
+    // provably empty by construction (the FoldReadError trap, not recording, arms on that path),
+    // which is the STRONGEST read proof there is. The mid dealt below then pins this domain.
+    const domain = this.resolveDomain(f.entry.name, f.args, f.entry.writes, f.entry.reads);
+    f.entry.domain = domain;
+    const { mid, seq } = this.dealMid(domain);
     f.entry.mid = mid;
-    void this.source.pushMutation({ clientID: this.clientID, mid, name: f.entry.name, args: f.args });
+    f.entry.seq = seq;
+    void this.channelFor(domain).pushMutation({ clientID: this.clientID, mid, name: f.entry.name, args: f.args });
     f.resolveMid(mid);
   }
 
+  /** The transport a `domain`-confirmed mutation ships on (§7.5 sent-pins-domain: only the
+   *  domain's own authority can confirm it, so its channel is the only correct transport). A
+   *  domain with NO connected gate ships on the daemon channel — the gate-less configurations
+   *  (`__testRelease`-driven tests) and today's entire live path resolve `"daemon"` anyway. */
+  private channelFor(domain: string): OptimisticSource {
+    return (this.gates.get(domain) ?? this.daemonGate).source;
+  }
+
+  /** The gate a channel-keyed retain registers through (G-iii registration-time routing). The
+   *  channel MUST already be connected (`connectSource`; the daemon is constructor-attached) —
+   *  loud by design: a typo'd or not-yet-connected sourceKey must throw at retain time, never
+   *  silently register on the daemon and split the query's frames across channels. */
+  private requireGate(channel: string): SourceGate {
+    const gate = this.gates.get(channel);
+    if (!gate) {
+      throw new Error(
+        `optimistic backend: no source connected for channel ${JSON.stringify(channel)} — call connectSource(${JSON.stringify(channel)}, source) before retaining a query on it`,
+      );
+    }
+    return gate;
+  }
+
+  /** The channel that owns `sourceQid` — {@link RemoteSub.channel}, the ONE source of truth for
+   *  qid routing (G-iii). `undefined` when no sub owns the qid (a harness-delivered raw feed, or
+   *  a just-released sub): such frames buffer on whatever gate they arrive at. */
+  private channelOf(sourceQid: QueryId): string | undefined {
+    const key = this.sourceToRemote.get(sourceQid);
+    return key ? this.remoteSubs.get(key)?.channel : undefined;
+  }
+
+  // --- the §3.3 deopt handshake, client half (H-v) ---------------------------------
+  //
+  // THE NAMED INVARIANT (Slice I inherits it): **never retire a room-domain entry off a
+  // daemon-carried lmid without outcome resolution.** On the room socket it holds by
+  // construction: every room lmid folds through the room's OWN gate, whose socket also carries
+  // the outcome frames — same-socket ordering puts the frame before the ack, and the reconnect
+  // re-send re-earns a lost frame, so a room-domain entry is only ever retired as a success when
+  // the room really applied it. Slice I's downgrade path breaks that coupling: the doc-scoped
+  // ledger row becomes readable THROUGH THE DAEMON with no room socket alive (§7.1 "load-bearing
+  // for §7.5"), and an lmid adopted that way covers burnt non-applied mids with no frame to say
+  // so — retiring a deopted entry there as a silent success is exactly the lost-write this
+  // handshake exists to prevent. ENFORCED since I-iii by {@link foldSystemFrames}: the I-ii
+  // outcome ROWS (co-committed, in ONE daemon transaction, with the ledger row that covers them)
+  // are synthesized into frames and routed through THIS machine BEFORE the ledger fold advances
+  // the domain watermark — one verdict path for frames and rows, with the processed set as the
+  // cross-release resolved-verdict memory, and absence-under-a-covering-lmid = applied (I-ii's
+  // atomicity makes that the sound default).
+
+  /** Record `(domain, mid)` as processed; `false` if it already was (a duplicate frame —
+   *  ignore it). FIFO-capped per domain ({@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}). */
+  private markOutcomeProcessed(domain: string, mid: number): boolean {
+    let mids = this.outcomesProcessed.get(domain);
+    if (!mids) this.outcomesProcessed.set(domain, (mids = new Set()));
+    if (mids.has(mid)) return false;
+    mids.add(mid);
+    while (mids.size > MAX_PROCESSED_OUTCOMES_PER_DOMAIN) {
+      mids.delete(mids.values().next().value as number);
+    }
+    return true;
+  }
+
+  /** One `mutationOutcome` frame from `domain`'s channel (H-v — the §3.3 handshake's client
+   *  half). The frame arrives OUT-OF-BAND (see {@link attachGate}); the state machine:
+   *
+   *  1. `mid` never issued on `domain` ⇒ ignore (a confused/foreign frame must not invent work).
+   *  2. `(domain, mid)` already processed ⇒ ignore — idempotence under duplicate frames (the
+   *     original + a re-send's re-answer; a deopt for a mid whose entry ALREADY FLIPPED also
+   *     lands here harmlessly on its second frame).
+   *  3. `kind:"rejected"` ⇒ FINAL. Surface the reason through {@link rejectedHandler} (room-plane
+   *     parity with the HTTP queue's callback) and STOP — the drop + snap-back is the EXISTING
+   *     failed-mutation machinery: the room burnt the mid, its lmid release retires the entry
+   *     per-domain and the reconcile rewinds the prediction, exactly the daemon path's
+   *     processed-as-no-op rejection. No new drop path.
+   *  4. `kind:"deopt"`, entry found (pending `(domain, mid)`) ⇒ FLIP IN PLACE: `domain` becomes
+   *     `"daemon"`, a fresh daemon mid is dealt and the envelope ships NOW on the daemon channel
+   *     ("deal-and-send-now" — the conforming §3.3 re-enqueue: there is no flush machinery for
+   *     non-fold entries, so the design's "mid: null until the daemon flush" is satisfied
+   *     momentarily inside this call). THE ENTRY'S `seq` IS KEPT — settled (§5.3, commit
+   *     68141096): `seq` is the client-global REPLAY order; re-sequencing would move the entry's
+   *     overlay position and change read-dependent SIBLINGS' replay base. Everything else stays
+   *     (writes/reads/touched/touchedSources/writeSources — union-never-shrink), the prediction
+   *     stays applied (the entry never leaves `pendingMutations`, so no rewind fires), and the
+   *     router does NOT re-run nor does `drainOverlapping` (§3.3 re-enqueues, never re-derives;
+   *     any open overlapping fold was invoked later and flushes later with a larger mid).
+   *  5. `kind:"deopt"`, entry NOT found ⇒ the burnt-mid confirm won the race, or the frame is a
+   *     replay re-answer for an entry a previous session retired (the replay gotcha): re-invoke
+   *     the frame's echoed `name`/`args` as a FRESH invocation PINNED to `"daemon"` — an honest
+   *     re-prediction on the current base, never a derived route ({@link invokeWith}). A frame
+   *     without `name` (not self-contained) has nothing to re-invoke and is dropped; a re-invoke
+   *     that THROWS (the base moved from under it) is surfaced through {@link rejectedHandler} —
+   *     the mutation is dead with no stream left to confirm it.
+   *
+   *  A `"deopt"` bump joins the Q6 routing counters either way (`routing.reasons.deopt`) —
+   *  derived-and-deopted routes are visible beside derived successes. */
+  private handleMutationOutcome(domain: string, frame: MutationOutcomeFrame): void {
+    if (frame.mid >= (this.nextMid.get(domain) ?? 1)) return; // never issued here — not ours
+    if (!this.markOutcomeProcessed(domain, frame.mid)) return; // duplicate frame
+    if (frame.kind === "rejected") {
+      const entry = this.pendingMutations.find((p) => p.domain === domain && p.mid === frame.mid);
+      this.rejectedHandler(
+        {
+          clientID: this.clientID,
+          mid: frame.mid,
+          name: entry?.name ?? frame.name ?? "",
+          args: entry !== undefined ? entry.args : frame.args,
+        },
+        frame.reason ?? "mutation rejected",
+      );
+      return;
+    }
+    // kind === "deopt": Q6's completion — how often a routed mutation came back refused.
+    this.routingReasons.set("deopt", (this.routingReasons.get("deopt") ?? 0) + 1);
+    const entry = this.pendingMutations.find((p) => p.domain === domain && p.mid === frame.mid);
+    if (entry) {
+      entry.domain = "daemon";
+      // Deal the fresh daemon mid but DISCARD its seq — the entry keeps its own (state-machine
+      // step 4 above; the harmless dealSeq bump is accepted). This is the ONE place a dealt seq
+      // is dropped, so "within one domain seq order == mid order" weakens to "except deopt
+      // re-enqueues" — see the {@link PendingMutation.seq} doc.
+      const { mid } = this.dealMid("daemon");
+      entry.mid = mid;
+      void this.channelFor("daemon").pushMutation({ clientID: this.clientID, mid, name: entry.name, args: entry.args });
+      return;
+    }
+    if (frame.name === undefined) return; // not self-contained — nothing to re-invoke
+    try {
+      this.invokeWith(frame.name, frame.args, "daemon");
+    } catch (err) {
+      this.rejectedHandler(
+        { clientID: this.clientID, mid: frame.mid, name: frame.name, args: frame.args },
+        `deopt re-invocation failed: ${String((err as Error)?.message ?? err)}`,
+      );
+    }
+  }
+
+  /** §7.5 rule 3 (H-v): re-send `domain`'s unconfirmed pending envelopes with their ORIGINAL
+   *  mids, in mid order, on the domain's own channel. Folds with `mid === null` are excluded —
+   *  nothing was ever sent for them (the flush deals their mid). Envelopes are reconstructed from
+   *  the pending entries exactly as `invoke` shipped them (`clientID`/`mid`/`name`/`args` —
+   *  entries carry everything the wire needs). Idempotent under the domain's ledger: an APPLIED
+   *  mid dedups silently and its lmid coverage retires the entry; a NON-APPLIED mid is re-answered
+   *  from the shell's recorded-outcome map into {@link handleMutationOutcome}. Confirmed entries
+   *  are already gone from `pendingMutations`, so no filter against the watermark is needed. */
+  private resendPending(domain: string): void {
+    const unconfirmed = this.pendingMutations
+      .filter((p) => p.domain === domain && p.mid !== null)
+      .sort((a, b) => a.mid! - b.mid!);
+    if (unconfirmed.length === 0) return;
+    const channel = this.channelFor(domain);
+    for (const p of unconfirmed) {
+      void channel.pushMutation({ clientID: this.clientID, mid: p.mid!, name: p.name, args: p.args });
+    }
+  }
+
   /** Drain every outstanding fold immediately (FOLDED-MUTATIONS-DESIGN §3): the explicit
    *  `app.flushFolds()` and the `beforeunload`/`close` hook. Creation (insertion) order. */
   flushFolds(): void {
@@ -897,7 +2218,17 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     const pending: PendingInspect[] = this.pendingMutations.map((p) => {
       const folded = foldByEntry.get(p);
       const key = p.mid != null ? `m:${p.mid}` : folded ? `f:${folded[0]}` : `?:${p.name}`;
-      const out: PendingInspect = { key, mid: p.mid, name: p.name, args: p.args, tables: [...p.touched] };
+      const writes: WriteRecord[] = [];
+      for (const byPk of p.writes.values()) for (const rec of byPk.values()) writes.push(rec);
+      const out: PendingInspect = {
+        key,
+        mid: p.mid,
+        name: p.name,
+        args: p.args,
+        tables: [...p.touched],
+        writes,
+        reads: { reads: [...p.reads.reads], queries: [...p.reads.queries] },
+      };
       if (folded) {
         const f = folded[1];
         out.fold = {
@@ -912,14 +2243,119 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     });
     return {
       pending,
-      confirmedLmid: this.confirmedLmid,
-      nextMid: this.nextMid,
-      appliedCv: this.appliedCv,
-      bufferedFrames: this.buffer.length,
+      // Back-compat scalars for the devtools `OptimisticInspect` mirror (unchanged shape): the DAEMON
+      // domain's ledger — the only one in single-domain. Per-domain state is `__inspectDomains()`.
+      confirmedLmid: this.watermark.get("daemon") ?? 0,
+      nextMid: this.nextMid.get("daemon") ?? 1,
+      appliedCv: this.daemonGate.appliedCv,
+      bufferedFrames: this.daemonGate.buffer.length,
       pendingTables: [...this.pendingTables()],
     };
   }
 
+  /** Test-only per-domain ledger snapshot (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1/§8.5).
+   *  Kept separate from {@link __inspect} so the devtools `OptimisticInspect` mirror stays byte-for-
+   *  byte identical (daemon-scalar-only). Exposes the per-domain `nextMid`/`watermark` maps plus each
+   *  pending entry's confirming domain — the axes the §8.5 ledger-isolation assertion checks. */
+  __inspectDomains(): {
+    nextMid: Record<string, number>;
+    watermark: Record<string, number>;
+    /** Per connected CHANNEL (§5.1): its release watermark + buffered-frame depth — the axis the
+     *  gate-isolation assertions read (one source's laggy cvMin must never move the other's) —
+     *  plus the §301 upstream-absorption advert last recorded from its progress frames (a ROOM
+     *  gate with a new shell; absent otherwise). */
+    gates: Record<string, { appliedCv: number; bufferedFrames: number; upstreamCv?: number; upstreamBoot?: string }>;
+    /** The §3 router's counters (H-iii) — Q6's measurement hook: how often derivation succeeded
+     *  (per derived room) and why it fell to the daemon (per reason). See {@link RoutingInspect}
+     *  for the counting discipline (per-candidate failures; pins bump nothing). */
+    routing: RoutingInspect;
+    /** The §4 lifecycle plane's folded state (Slice I-iii introspection): the per-doc §4.2 fence
+     *  value (`roomWatermarks`, I-v's ghost-drop input), the per-scope §4.1 occupancy map
+     *  (`scopeSessions`: scope → client_id → expires_at, I-iv's doorbell input), and the live
+     *  I-v ghosts (demoted room sources still awaiting their fence). */
+    lifecycle: {
+      roomWatermarks: Record<string, number>;
+      scopeSessions: Record<string, Record<string, number>>;
+      ghosts: Record<string, { doc: string; finalFlushSeq: number; tables: string[] }>;
+    };
+    /** The live §301 pin registry (`301-ECHO-FENCE-DESIGN.md` §2.5 — the devtools/Q6 surface):
+     *  every parked hold-back's fence inputs plus its tripwire state, keyed
+     *  `${table}\0${sourceKey}\0${pkKey}`. Pruned lazily, so an entry here may briefly outlive
+     *  its engine pin (never the reverse). */
+    pins: Record<
+      string,
+      {
+        table: string;
+        sourceKey: string;
+        domain: string;
+        mid: number;
+        daemonBoot?: string;
+        daemonCv?: number;
+        tripwired: boolean;
+      }
+    >;
+    /** The §301 direction-A fence map: per room domain, the highest DAEMON-CARRIED ledger lmid. */
+    daemonCarriedLmid: Record<string, number>;
+    pending: { mid: number | null; seq: number | null; name: string; domain: string; touchedSources: string[]; writeSources: Record<string, string> }[];
+  } {
+    return {
+      nextMid: Object.fromEntries(this.nextMid),
+      watermark: Object.fromEntries(this.watermark),
+      gates: Object.fromEntries(
+        [...this.gates].map(([k, g]) => [
+          k,
+          {
+            appliedCv: g.appliedCv,
+            bufferedFrames: g.buffer.length,
+            ...(g.upstreamCv !== undefined ? { upstreamCv: g.upstreamCv } : {}),
+            ...(g.upstreamBoot !== undefined ? { upstreamBoot: g.upstreamBoot } : {}),
+          },
+        ]),
+      ),
+      routing: {
+        derived: Object.fromEntries(this.routingDerived),
+        reasons: Object.fromEntries(this.routingReasons),
+      },
+      lifecycle: {
+        roomWatermarks: Object.fromEntries(this.roomWatermarks),
+        scopeSessions: Object.fromEntries(
+          [...this.scopeSessions].map(([scope, sessions]) => [scope, Object.fromEntries(sessions)]),
+        ),
+        ghosts: Object.fromEntries(
+          [...this.ghosts].map(([k, g]) => [k, { doc: g.doc, finalFlushSeq: g.finalFlushSeq, tables: [...g.tables] }]),
+        ),
+      },
+      pins: Object.fromEntries(
+        [...this.pins].map(([k, p]) => [
+          k,
+          {
+            table: p.table,
+            sourceKey: p.sourceKey,
+            domain: p.domain,
+            mid: p.mid,
+            ...(p.daemonBoot !== undefined ? { daemonBoot: p.daemonBoot } : {}),
+            ...(p.daemonCv !== undefined ? { daemonCv: p.daemonCv } : {}),
+            tripwired: p.tripwired === true,
+          },
+        ]),
+      ),
+      daemonCarriedLmid: Object.fromEntries(this.daemonCarriedLmid),
+      pending: this.pendingMutations.map((p) => ({
+        mid: p.mid,
+        // The client-global deal sequence — the REPLAY order (mids are per-domain, incomparable
+        // across domains; see PendingMutation.seq). The harness asserts send order with this.
+        seq: p.seq,
+        name: p.name,
+        domain: p.domain,
+        // The write-source axes (§5.3): which physical source(s) this entry's writes routed onto —
+        // the filter basis, and (per pk) the hold-back's cross-slice test. The harness asserts the
+        // filter/routing against its independent model with these.
+        touchedSources: [...p.touchedSources],
+        writeSources: Object.fromEntries(p.writeSources),
+      })),
+    };
+  }
+
   /** Recompute the pending axis for every query and fire `onPending` on transitions only. Called
    *  from the two points that move the pending set: invoke/invokeFolded (add) and the confirm-drop
    *  (remove) — exactly where `:359`/`:468` used to flip ResultType (§7.3). */
@@ -933,18 +2369,38 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     }
   }
 
-  // --- the downstream stream (§8.5: buffer, then release coherently) ---------------
-
-  private onNormalized(qid: QueryId, ev: NormalizedEvent): void {
-    if (qid !== LMID_QID) this.emitServerDelta(qid, ev);
+  // --- the downstream stream (§8.5: buffer, then release coherently — PER GATE, §5.1) ------
+
+  private onFrame(gate: SourceGate, qid: QueryId, ev: NormalizedEvent): void {
+    // Ownership is fixed at RETAIN time (G-iii registration-time routing: {@link RemoteSub.channel},
+    // the one source of truth) — a qid lives on the ONE channel its sub registered on. So a frame
+    // arriving on any OTHER gate means the server routed a qid to the wrong channel: a wiring bug —
+    // fail loudly rather than silently splitting one query's frames across two cv timelines. (This
+    // used to be a lazy first-arrival CLAIM; it is now a pure assertion.) A qid with NO sub (a
+    // harness-delivered raw feed) has no owner and buffers on the arriving gate; the per-channel
+    // reserved LMID_QID is exempt — each gate owns its own.
+    if (qid !== LMID_QID) {
+      const owner = this.channelOf(qid);
+      if (owner !== undefined && owner !== gate.key) {
+        // I-iv retarget grace: a frame already in flight from the sub's PREVIOUS channel when
+        // {@link retargetRemoteQuery} moved it (the unsubscribe races the server's last frames)
+        // is stale, not a wiring bug — drop it. The grace window is exactly the deferred-GC
+        // window: {@link flushRetargetGc} deletes the record, and the loud throw is restored.
+        if (this.pendingRetargetGc.get(qid) === gate.key) return;
+        throw new Error(`optimistic backend: qid ${qid} arrived on ${gate.key} but is owned by ${owner}`);
+      }
+    }
+    // System-plane frames (I-iii) are bookkeeping, not view data: like the lmid stream they skip
+    // the devtools server-delta tap (there is no local view to attribute them to).
+    if (qid !== LMID_QID && !this.systemQids.has(qid)) this.emitServerDelta(qid, ev);
     if (ev.type === "hello") {
       // A hello is a (re)subscribe = a NEW epoch. The column map below is mutated eagerly, but
-      // data frames are cv-buffered and drained later (onProgress). So any frame still buffered
-      // for this qid is from a SUPERSEDED epoch and must NOT be scattered through this epoch's
-      // (possibly changed) map — drop it. This epoch's snapshot, which always follows the hello,
-      // re-hydrates the qid from scratch, so the dropped frames are redundant. Scoped to this
-      // qid: other queries' frames (and the lmid system query's) keep their coherent release.
-      this.buffer = this.buffer.filter((f) => f.qid !== qid);
+      // data frames are cv-buffered and drained later (the gate's progress). So any frame still
+      // buffered for this qid is from a SUPERSEDED epoch and must NOT be scattered through this
+      // epoch's (possibly changed) map — drop it. This epoch's snapshot, which always follows the
+      // hello, re-hydrates the qid from scratch, so the dropped frames are redundant. Scoped to
+      // this qid: other queries' frames (and the lmid system query's) keep their coherent release.
+      gate.buffer = gate.buffer.filter((f) => f.qid !== qid);
       this.addServerDependencyTables(qid, ev.tables.map((t) => t.name));
       // Learn this query's per-table column map (PROJECTION-SUPPORT-DESIGN.md §5.2): map each
       // advertised column to its base ColId BY NAME. The hello may carry FEWER columns than the
@@ -962,15 +2418,15 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
         // Register a non-trivial map; otherwise revert to '*' — and CLEAR any stale map a prior
         // epoch left (a server that expanded then contracted back), so the now-exact rows don't
         // scatter through a `-1`-bearing layout (silent cell corruption).
-        if (cols.length !== full || cols.some((c, i) => c !== i)) this.sync.registerProjection(qid, t.name, cols);
-        else this.sync.unregisterProjection(qid, t.name);
+        if (cols.length !== full || cols.some((c, i) => c !== i)) gate.sync.registerProjection(qid, t.name, cols);
+        else gate.sync.unregisterProjection(qid, t.name);
       }
       return; // envelope validation is the source's job
     }
     const cv = ev.cv ?? 0;
-    if (cv <= this.appliedCv && ev.type === "batch") return; // stale redelivery
-    this.buffer.push({ cv, qid, kind: ev.type, ops: ev.ops, seq: this.nextSeq++ });
-    if (this.buffer.length > this.bufferCap) this.overflow();
+    if (cv <= gate.appliedCv && ev.type === "batch") return; // stale redelivery ON THIS TIMELINE
+    gate.buffer.push({ cv, qid, kind: ev.type, ops: ev.ops, seq: gate.nextSeq++ });
+    if (gate.buffer.length > this.bufferCap) this.overflow(gate);
   }
 
   private emitServerDelta(sourceQid: QueryId, ev: NormalizedEvent): void {
@@ -988,89 +2444,577 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     return localQids.length ? localQids : [sourceQid];
   }
 
-  private onProgress(frame: ProgressFrame): void {
+  /** One gate's release (§5.1 release gate): compute the coherent delta from THIS gate's cv-buffer,
+   *  then apply it against the gate's source/domain. Split into {@link computeRelease} (buffer →
+   *  delta, lmid → watermark) and {@link applyRelease} (per-source confirm-drop + reconcile) —
+   *  N independent gates all feed the ONE apply half; {@link __testRelease} drives it directly. */
+  private onGateProgress(gate: SourceGate, frame: ProgressFrame): void {
+    // §301 direction B: record the frame's upstream-absorption advert BEFORE the release applies,
+    // so the drop pass at applyRelease's tail evaluates exactly this release's advert — the room
+    // emits data-then-progress on one socket, so by the time the advert says "absorbed through
+    // cv U" the re-published echo data is in this release's fold (never ahead of it). Verbatim,
+    // not max-folded: on a daemon restart the advertised cv space legitimately resets and the
+    // §2.4 boot rule (not monotonicity) carries the ordering.
+    if (frame.upstreamCv !== undefined) {
+      gate.upstreamCv = frame.upstreamCv;
+      gate.upstreamBoot = frame.upstreamBoot;
+    }
+    const { deltas, newlyHydrated, touchedScopes } = this.computeRelease(gate, frame);
+    this.applyRelease(gate.key, deltas, undefined, newlyHydrated);
+    // I-iv phase 2: a retargeted sub whose first ROOM snapshot released just now gets its old
+    // channel's rows GC'd — AFTER the release fully applied, so the winner flip is value-equal
+    // against the freshly-folded room rows (never a remove-before-the-refill).
+    this.flushRetargetGc(gate);
+    // I-iv doorbell events LAST — everything this release carried (data, confirms, the occupancy
+    // fold itself, the retarget cutover) is already applied when the consumer's reaction (an
+    // async re-lease) is kicked off. One event per touched scope, count evaluated at the fold
+    // clock's now (deterministic under an injected clock).
+    if (touchedScopes !== null) {
+      for (const scope of touchedScopes) {
+        this.scopeSessionsHandler({ scope, others: this.otherScopeSessions(scope) });
+      }
+    }
+  }
+
+  /** Compute one coherent release from ONE gate's cv-buffer (§5.1) — gate-scoped: its buffer, its
+   *  cvMin timeline. Take every buffered frame at `cv ≤ cvMin`, in (cv, arrival) order, and fold
+   *  it: the lmid system-query frame advances `watermark[gate.key]` (via {@link foldLmidOps} — the
+   *  daemon stream folds "daemon", a room stream folds its own domain); data frames fold through
+   *  this SOURCE's cross-query refcount into ONE net base delta — the §1.3 `D`. Returns that delta
+   *  plus the set of local views this release JUST hydrated (so their reconcile batch phases as a
+   *  `snapshot`). Mutates the gate's buffer/`appliedCv`, hydration, and the gate's domain
+   *  watermark; the pending set and the reconcile are {@link applyRelease}'s job. */
+  private computeRelease(
+    gate: SourceGate,
+    frame: ProgressFrame,
+  ): { deltas: Mutation[]; newlyHydrated: Set<QueryId> | null; touchedScopes: Set<string> | null } {
     // Snapshot which local views are already hydrated BEFORE this release folds: any that cross into
     // hydrated below get their first result set as this cycle's batch, which must phase as a snapshot.
     const wasHydrated = new Set(this.hydrated);
-    // (1) Take every buffered frame at cv ≤ cvMin, in (cv, arrival) order, and fold it:
-    // lmid system-query frames advance `confirmedLmid`; data frames fold through the
-    // cross-query refcount into ONE net base delta — the §1.3 `D`. Confirmation and
-    // data of the same commit share a cv, so they release together by construction.
-    const ready = this.buffer
+    const ready = gate.buffer
       .filter((f) => f.cv <= frame.cvMin)
       .sort((a, b) => a.cv - b.cv || a.seq - b.seq);
-    this.buffer = this.buffer.filter((f) => f.cv > frame.cvMin);
+    gate.buffer = gate.buffer.filter((f) => f.cv > frame.cvMin);
+    // The §4 lifecycle SYSTEM frames fold FIRST, in a FIXED structural category order (Slice
+    // I-iii; see {@link foldSystemFrames} for why the order is load-bearing), then the ordinary
+    // lmid + data frames fold exactly as before. With no system retain the partition is empty and
+    // this release is byte-identical to pre-I-iii. The returned scope set feeds the I-iv doorbell
+    // events `onGateProgress` fires once the WHOLE release has applied.
+    const touchedScopes = this.foldSystemFrames(ready.filter((f) => this.systemQids.has(f.qid)));
     const muts: Mutation[] = [];
     for (const f of ready) {
+      if (this.systemQids.has(f.qid)) {
+        // Folded above; a system stream has no store view and MUST NOT enter the sync layer (its
+        // tables are not in the schema) — but its first snapshot still marks the sub hydrated so
+        // the overflow/introspection bookkeeping stays uniform.
+        if (f.kind === "snapshot") this.markSubHydrated(f.qid);
+        continue;
+      }
       if (f.qid === LMID_QID) {
-        this.foldLmidOps(f.ops);
+        // Confirmation and data of the same commit share a cv, so they release together — each
+        // channel's lmid stream folds into ITS OWN domain's watermark (§7.1).
+        this.foldLmidOps(f.ops, gate.key);
         continue;
       }
       muts.push(
-        ...(f.kind === "snapshot" ? this.sync.rehydrate(f.qid, f.ops) : this.sync.applyBatch(f.qid, f.ops)),
+        ...(f.kind === "snapshot" ? gate.sync.rehydrate(f.qid, f.ops) : gate.sync.applyBatch(f.qid, f.ops)),
       );
       // A query's first released snapshot is its hydration point — even an empty one (0 rows is an
       // authoritative answer): lift every local view this sub feeds out of `unknown` (loading).
       if (f.kind === "snapshot") this.markSubHydrated(f.qid);
     }
-    this.appliedCv = Math.max(this.appliedCv, frame.cvMin);
+    gate.appliedCv = Math.max(gate.appliedCv, frame.cvMin);
+    let newlyHydrated: Set<QueryId> | null = null;
+    for (const qid of this.hydrated) {
+      if (!wasHydrated.has(qid)) (newlyHydrated ??= new Set()).add(qid);
+    }
+    return { deltas: muts, newlyHydrated, touchedScopes };
+  }
 
-    // (2) Drop confirmed pending (§1.3 step 5's bookkeeping half): mid ≤ the lmid this
-    // release itself delivered. A failed mutation drops the same way — the release just
-    // carries no effects for it, so the rewind in (3) snaps the prediction back. An UNFLUSHED
-    // folded entry (`mid == null`) is never confirmable — it has not crossed the wire — so it is
-    // always retained until its own flush stamps a real mid (FOLDED-MUTATIONS-DESIGN §4.1).
+  /** Apply one released delta against `sourceKey`'s domain (§7.2 per-domain confirm-drop + the §1.3
+   *  reconcile cycle). `watermarkUpdate`, when given, advances `watermark[sourceKey]` first — the
+   *  hook a per-source lmid confirm rides on (the daemon path folds its watermark in
+   *  {@link computeRelease} and passes `undefined`). Then: drop every pending entry its OWN domain's
+   *  watermark now covers (a room confirm can never retire a daemon entry, and vice-versa — the §7.1
+   *  ledger-collision fix), and run the reconcile cycle against `sourceKey` when the base delta or the
+   *  pending set changed. `newlyHydrated` stamps the initial-hydration batch as a catch-up. */
+  private applyRelease(
+    sourceKey: string,
+    deltas: Mutation[],
+    watermarkUpdate?: number,
+    newlyHydrated: Set<QueryId> | null = null,
+  ): void {
+    if (watermarkUpdate !== undefined) {
+      this.watermark.set(sourceKey, Math.max(this.watermark.get(sourceKey) ?? 0, watermarkUpdate));
+    }
+    // Echo hold-back (§7.3), BEFORE the confirm-drop: an entry `p` this release CONFIRMS
+    // (`p.mid <= watermark[p.domain]`) but which staged a write onto a DIFFERENT source `S` (a
+    // cross-slice write — e.g. a room-domain mutation whose write routed to the daemon slice) is
+    // about to leave `pendingMutations`, so it will NOT be re-invoked on `S`'s next rewind. Park each
+    // such write inertly on `S` so that rewind (which un-applies the not-re-invoked write) does not
+    // flash-revert it. Two variants, one per write shape (G-i unified them engine-side):
+    //   - ADD/EDIT (`rec.row` present): pinned PRESENCE — drops when `S`'s confirmed baseline
+    //     value-matches (its echo lands — the E-i-tested drop).
+    //   - REMOVE (`rec.row === undefined`, G-iii): pinned ABSENCE — the §7.3 tombstone, parked with
+    //     the captured pre-image (`rec.oldRow`) so `S`'s rewind cannot resurrect the deleted row;
+    //     drops when `S`'s baseline lacks the pk (the delete echoed).
+    // Inert in single-domain: every write's source equals its domain.
+    for (const p of this.pendingMutations) {
+      if (p.mid === null || p.mid > (this.watermark.get(p.domain) ?? 0)) continue; // not confirmed now
+      for (const [table, byPk] of p.writes) {
+        // The Collapsed-park gate (G-iii): NEVER park on an un-promoted table. Inert-anyway today
+        // (`rewind_collapsed` never consults `held_back`), so skipping is behaviorally identical —
+        // but a stale Collapsed-era entry would become overlay-first-visible (a permanent pin) if
+        // the table later promotes. Slice H's prove-or-slow-path routing makes the real scenario
+        // (a room-confirmed mutation writing a Collapsed table) impossible; this covers until then.
+        if (!this.promotedTables.has(table)) continue;
+        for (const [pkKey, rec] of byPk) {
+          const s = p.writeSources.get(writeSourceKey(table, pkKey));
+          if (s === undefined || s === p.domain) continue; // same-slice: the rewind replays it
+          if (rec.row !== undefined) this.local.holdBack(table, s, rec.row);
+          else if (rec.oldRow !== undefined) this.local.holdBackAbsent(table, s, rec.oldRow);
+          else continue;
+          // §301 §2.1: register the pin's delivery-fence inputs in the same breath as the park.
+          this.registerPin(table, s, pkKey, rec.row ?? (rec.oldRow as WireValue[]), p);
+        }
+      }
+    }
+    // Drop confirmed pending (§1.3 step 5's bookkeeping half), PER DOMAIN: an entry is retired only
+    // when ITS domain's watermark reaches its mid — so two concurrent streams never alias one counter
+    // (§7.1). A failed mutation drops the same way (the release carries no effects, so the rewind snaps
+    // the prediction back). An UNFLUSHED fold (`mid == null`) is never confirmable — retained until its
+    // flush stamps a real mid (FOLDED-MUTATIONS-DESIGN §4.1), regardless of any domain's watermark.
+    // H-v NOTE — retiring here treats coverage as SUCCESS, which for a room domain is sound only
+    // because outcome resolution ALWAYS precedes the coverage that retires: on the room socket
+    // the outcome frames outrun the lmid acks (same-socket ordering + the resync re-send), and on
+    // the daemon-carried path (I-iii) `foldSystemFrames` routes the co-committed outcome ROWS
+    // through handleMutationOutcome BEFORE the ledger fold advances the watermark this filter
+    // reads — a deopted entry has already flipped off the domain by the time its burnt mid is
+    // covered, either way (the named invariant above handleMutationOutcome).
     const before = this.pendingMutations.length;
-    this.pendingMutations = this.pendingMutations.filter((p) => p.mid === null || p.mid > this.confirmedLmid);
+    this.pendingMutations = this.pendingMutations.filter(
+      (p) => p.mid === null || p.mid > (this.watermark.get(p.domain) ?? 0),
+    );
     const pendingChanged = this.pendingMutations.length !== before;
 
-    // (3) The reconcile cycle — only when something can have changed: a base delta to
-    // fold in, or a pending set that shrank (its optimistic layer must rewind out). The batch it
-    // emits for any view that JUST became hydrated is that view's initial result set, so mark those
-    // qids so the local-event forwarder stamps their batch `catchUp` (→ Store phases it `snapshot`).
-    if (muts.length || pendingChanged) {
-      let newlyHydrated: Set<QueryId> | null = null;
-      for (const qid of this.hydrated) {
-        if (!wasHydrated.has(qid)) (newlyHydrated ??= new Set()).add(qid);
-      }
+    // The reconcile cycle — only when something can have changed: a base delta to fold in, or a
+    // pending set that shrank (its optimistic layer must rewind out). The batch it emits for any view
+    // that JUST became hydrated is that view's initial result set, so mark those qids so the
+    // local-event forwarder stamps their batch `catchUp` (→ Store phases it `snapshot`).
+    if (deltas.length || pendingChanged) {
+      const emitted = (this.catchUpEmitted = new Set<QueryId>());
       this.catchUpQids = newlyHydrated;
       try {
-        this.runReconcileCycle(muts);
+        this.runReconcileCycle(sourceKey, deltas);
       } finally {
         this.catchUpQids = null;
+        this.catchUpEmitted = null;
       }
+      // Drop the qids the reconcile actually delivered a batch for; the rest folded nothing.
+      if (newlyHydrated) for (const qid of emitted) newlyHydrated.delete(qid);
     }
 
-    // (4) ResultType is the SERVER CHANNEL's state only now (§7): `unknown` while not hydrated,
-    // else `complete` — a pending mutation no longer moves it. The pending axis moves separately.
+    // ResultType is the SERVER CHANNEL's state only now (§7): `unknown` while not hydrated, else
+    // `complete` — a pending mutation no longer moves it. The pending axis moves separately.
     for (const qid of this.queryTables.keys()) {
       this.setResultType(qid, this.hydrated.has(qid) ? "complete" : "unknown");
     }
+    // A newly-hydrated query whose reconcile emitted NO batch (0 rows, its whole result already present
+    // via a sibling → 0 net muts, or the reconcile was skipped) still needs a hydration signal, or its
+    // SSR seed never retires and the view freezes. Send an explicit empty catch-up (now that it reads
+    // `complete`, the Store retires the seed and reveals whatever is already in its tree).
+    if (newlyHydrated) {
+      for (const qid of newlyHydrated) this.handler(qid, { type: "batch", events: [], catchUp: true });
+    }
     this.refreshPending();
+    // The §301 echo-fence drop pass — strictly AFTER the reconcile above folded this release's
+    // data, so a fence that cleared in this release drops its pin only once the co-committed
+    // echo data is actually in the baseline (dropping earlier would itself reopen the flash
+    // window §7.3 closes). Structural no-op with no pins (every single-domain client).
+    this.dropEchoFencePins();
+    // The I-v ghost-drop watcher (§4.2), LAST: this release's watermark rows have folded
+    // (computeRelease) and its confirm-drop has retired what it covers — exactly the two inputs
+    // the drop condition reads. Structural no-op with no ghost.
+    this.evaluateGhosts();
+  }
+
+  /** Test-only per-source release seam (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.2/§8.5): drive
+   *  {@link applyRelease} for `sourceKey` directly — an explicit `watermarkUpdate` (a simulated lmid
+   *  confirm for that domain) and `deltas` (a coherent base delta), with no real gate. Lets a harness
+   *  exercise a room-domain confirm before the real second lmid stream / per-source gate is wired
+   *  (E-iii-b/c). The `__`-prefix marks it a test hook, alongside {@link __inspect}. */
+  __testRelease(sourceKey: string, deltas: Mutation[], watermarkUpdate?: number): void {
+    this.applyRelease(sourceKey, deltas, watermarkUpdate);
+  }
+
+  // --- the §301 echo fences (301-ECHO-FENCE-DESIGN.md) -----------------------------------
+
+  /** Register (or overwrite — a later cross-slice confirm re-pinning the same slice-pk matches
+   *  the engine's `held_back.insert`) one {@link EchoFencePin}, in the same breath as the
+   *  engine park (§2.1). `p` is the confirmed entry whose write staged onto `sourceKey`; its
+   *  `mid` is non-null by the caller's confirm filter. */
+  private registerPin(
+    table: string,
+    sourceKey: string,
+    pkKey: string,
+    probeRow: WireValue[],
+    p: PendingMutation,
+  ): void {
+    const pin: EchoFencePin = {
+      table,
+      sourceKey,
+      probeRow,
+      domain: p.domain,
+      mid: p.mid as number,
+    };
+    if (sourceKey !== "daemon" && p.domain === "daemon") {
+      // Direction B stamps (§1.2): the parking daemon release's coherence position — the confirm
+      // folded at-or-before it, so a room advertising absorption ≥ this cv has absorbed the
+      // commit that carried the write — plus the client-observed boot it belongs to (§2.4).
+      pin.daemonCv = this.daemonGate.appliedCv;
+      if (this.daemonBootId !== undefined) pin.daemonBoot = this.daemonBootId;
+    }
+    // The tripwire reference (§2.5): the slice's confirmed-baseline row at park.
+    pin.baselineAtPark = this.local.heldBackState(table, sourceKey, probeRow)?.baseline as
+      | WireValue[]
+      | undefined;
+    this.pins.set(`${table}\0${sourceKey}\0${pkKey}`, pin);
+  }
+
+  /** The §2.3 drop pass, run at the tail of every applied release: prune registry entries whose
+   *  engine pin is already gone (the rewind's state-match fallback or a whole-source removal beat
+   *  the fence — benign), drop every pin whose fence cleared (one engine drop each, delivered on
+   *  the ordinary event stream, bracketed as ONE notification commit), and tripwire the rest. */
+  private dropEchoFencePins(): void {
+    if (this.pins.size === 0) return; // every single-domain client: structural no-op
+    let cleared: [string, EchoFencePin][] | null = null;
+    for (const [key, pin] of this.pins) {
+      const state = this.local.heldBackState(pin.table, pin.sourceKey, pin.probeRow);
+      if (state === undefined) {
+        this.pins.delete(key); // engine pin gone (state-match / source removal): lazy prune
+        continue;
+      }
+      if (this.pinFenceCleared(pin)) (cleared ??= []).push([key, pin]);
+      else this.maybeTripwirePin(key, pin, state.baseline as WireValue[] | undefined);
+    }
+    if (!cleared) return;
+    this.inOneCommit(() => {
+      for (const [key, pin] of cleared) {
+        this.pins.delete(key);
+        this.local.dropHeldBack(pin.table, pin.sourceKey, pin.probeRow);
+      }
+    });
+  }
+
+  /** Has `pin`'s delivery fence provably closed its confirm→echo window? (§2.3/§2.4.) */
+  private pinFenceCleared(pin: EchoFencePin): boolean {
+    if (pin.sourceKey === "daemon") {
+      // Direction A: the daemon-carried ledger for the confirming room domain covers the mid —
+      // the I-ii co-commit means this release (or an earlier one) folded the flush data that
+      // carried it into the daemon baseline (§1.1).
+      return (this.daemonCarriedLmid.get(pin.domain) ?? 0) >= pin.mid;
+    }
+    // Direction B: only a daemon-confirmed write has the daemon-cv stamp; a room-staged pin
+    // confirmed by ANOTHER room (outside today's two-tier topology) has no fence.
+    if (pin.daemonCv === undefined) return false;
+    const gate = this.gates.get(pin.sourceKey);
+    if (!gate || gate.upstreamCv === undefined) return false; // no advert (old shell): §2.5 fallback
+    if (gate.upstreamBoot === pin.daemonBoot) return gate.upstreamCv >= pin.daemonCv;
+    // Boot mismatch (§2.4): a boot the client has OBSERVED as later proves absorption (the
+    // room's post-restart re-snapshot came from daemon state that durably includes the
+    // confirmed write); an unknown/older/unstamped boot holds — conservative, its next
+    // re-snapshot advances it.
+    if (pin.daemonBoot === undefined || gate.upstreamBoot === undefined) return false;
+    const pinOrd = this.daemonBootOrdinals.get(pin.daemonBoot);
+    const advOrd = this.daemonBootOrdinals.get(gate.upstreamBoot);
+    return pinOrd !== undefined && advOrd !== undefined && advOrd > pinOrd;
   }
 
-  /** Fold the lmid system query's released ops (lmid-as-data): the one row's
-   *  `last_mutation_id` cell is this client's confirmed high-water mid. */
-  private foldLmidOps(ops: NormalizedOp[]): void {
+  /** The §2.5 stuck-pin tripwire, in the scopesHash spirit: log ONCE per pin when its slice's
+   *  baseline row has CHANGED VALUE since park while the pin still holds — the suspicious state
+   *  that precedes every forever-pin (a fence-less pairing, a fence bug). Never drops anything. */
+  private maybeTripwirePin(key: string, pin: EchoFencePin, baseline: WireValue[] | undefined): void {
+    if (pin.tripwired) return;
+    const same =
+      pin.baselineAtPark === undefined || baseline === undefined
+        ? pin.baselineAtPark === baseline
+        : pin.baselineAtPark.length === baseline.length &&
+          pin.baselineAtPark.every((c, i) => identicalCell(c, baseline[i]));
+    if (same) return;
+    pin.tripwired = true;
+    const [table, sourceKey, pkKey] = key.split("\0");
+    console.warn(
+      `rindle: a §7.3 hold-back pin on table "${table}" slice "${sourceKey}" pk ${pkKey} (confirming domain ${pin.domain}, mid ${pin.mid}) is parked while its slice's baseline moved past it — if this client never converges on that row, this pin is why (301-ECHO-FENCE-DESIGN.md §2.5).`,
+    );
+  }
+
+  /** Record one observed daemon boot id (§2.4): first observation of an id assigns the next
+   *  ordinal (the client's own total order over opaque boot ids); every call refreshes the
+   *  current-boot stamp for direction-B parks. */
+  private observeDaemonBoot(bootId: string): void {
+    if (!this.daemonBootOrdinals.has(bootId)) {
+      this.daemonBootOrdinals.set(bootId, this.daemonBootOrdinals.size);
+    }
+    this.daemonBootId = bootId;
+  }
+
+  /** Promote `table` to a MERGED multi-source engine with room `sourceKey`'s per-row writable
+   *  scope (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §5.2) — THE one promotion seam. The engine
+   *  attach and the {@link promotedTables} record move in the same breath: the §7.3 hold-back
+   *  trigger in {@link applyRelease} parks ONLY on promoted tables, so a promotion that bypassed
+   *  the record would silently disable the echo hold-back for that table (and a record without the
+   *  engine attach would park onto a slice that doesn't exist). Recorded AFTER the engine accepts —
+   *  a rejected descriptor/table must not leave a phantom promotion. Slice G-v's client drives this
+   *  from the lease's `realtime.tables` (`RoomTableSpec` → {@link WritableDescriptor}); idempotence
+   *  per `(sourceKey, table)` is the CALLER's job (the engine refuses a duplicate room).
+   *
+   *  `spec` (H-iii) is the per-table ROUTING spec riding the same lease table block — recorded
+   *  into {@link roomRouting} (THE routing table the §3 router reads) in the same breath, with
+   *  `writable` derived from the descriptor's kind (`none` = a context table the room may not
+   *  write). Omitted (the E-iii-b harness alias below) ⇒ an empty spec: no join keys to guard, no
+   *  `footprintWhere` (that room's reads then fail closed to the daemon unless self/room-served). */
+  promoteRoomTable(
+    table: string,
+    sourceKey: string,
+    writable: WritableDescriptor,
+    spec?: RoomTableRoutingSpec,
+  ): void {
+    this.local.addRoomSource(table, sourceKey, writable);
+    this.promotedTables.add(table);
+    let byTable = this.roomRouting.get(sourceKey);
+    if (!byTable) this.roomRouting.set(sourceKey, (byTable = new Map()));
+    byTable.set(table, {
+      writable: writable.kind !== "none",
+      joinKeyCols: [...(spec?.joinKeyCols ?? [])],
+      ...(spec?.where !== undefined ? { where: spec.where } : {}),
+      ...(spec?.footprintWhere !== undefined ? { footprintWhere: spec.footprintWhere } : {}),
+    });
+  }
+
+  /** The recorded routing specs for `sourceKey`'s promoted tables (table → its
+   *  {@link RoomTableRouting}) — read-only: the client's `__realtimeInspect`/idempotence
+   *  bookkeeping reads THIS record instead of keeping its own shadow copy (one source of truth).
+   *  Empty map when the room has promoted nothing. */
+  roomTablesFor(sourceKey: string): ReadonlyMap<string, RoomTableRouting> {
+    return this.roomRouting.get(sourceKey) ?? EMPTY_ROUTING;
+  }
+
+  /** Test-named alias of {@link promoteRoomTable} (E-iii-b scaffolding — the multi-domain oracle
+   *  and per-source-gate suites drive it). Pure delegation: ONE body, one `promotedTables` record. */
+  __addRoomSource(table: string, roomKey: string, writable: WritableDescriptor, spec?: RoomTableRoutingSpec): void {
+    this.promoteRoomTable(table, roomKey, writable, spec);
+  }
+
+  /** Fold `domain`'s lmid system query's released ops (lmid-as-data): the one row's
+   *  `last_mutation_id` cell is this client's confirmed high-water mid in that domain — it advances
+   *  `watermark[domain]` and, on a fresh session ahead of our issued mids, `nextMid[domain]`. The
+   *  daemon stream folds `"daemon"`; a room stream folds its own `"room:doc:X"`; the daemon-carried
+   *  §7.1 ledger rows fold through the same {@link foldConfirm} core (Slice I-iii). */
+  private foldLmidOps(ops: NormalizedOp[], domain: string): void {
     for (const op of ops) {
       const row = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
       if (!row) continue; // a remove (client GC) confirms nothing
-      const lmid = Number(row[1]);
-      if (!Number.isFinite(lmid)) continue;
-      if (lmid > this.nextMid - 1) {
-        if (this.pendingMutations.length > 0) {
-          // The server confirmed a mid we never issued while we have mutations in
-          // flight — two writers on one clientID or corrupted state. Unrecoverable.
-          throw new Error(
-            `optimistic backend: confirmed lmid ${lmid} is ahead of issued mids (${this.nextMid - 1})`,
-          );
+      this.foldConfirm(domain, Number(row[1]));
+    }
+  }
+
+  /** THE one confirm fold (§7.1/§7.2): advance `watermark[domain]` to `lmid` (monotone max) and,
+   *  on a fresh session ahead of our issued mids, adopt `nextMid[domain]`. Shared verbatim by the
+   *  per-channel lmid system query ({@link foldLmidOps}) and the daemon-carried room-ledger rows
+   *  ({@link foldSystemFrames} — one core so the two paths cannot drift). */
+  private foldConfirm(domain: string, lmid: number): void {
+    if (!Number.isFinite(lmid)) return;
+    const highestIssued = (this.nextMid.get(domain) ?? 1) - 1;
+    if (lmid > highestIssued) {
+      // Only in-flight mutations of THIS domain can contradict its watermark (§7.1: the counters
+      // are independent — a room-domain mutation pending while the daemon's historical lmid
+      // snapshot arrives is a normal fresh-session interleaving, not a second writer). An
+      // unflushed fold (`mid == null`) has issued nothing yet either way: it cannot explain a
+      // confirmed-ahead lmid, and its eventual flush deals from the adopted counter below.
+      if (this.pendingMutations.some((p) => p.domain === domain && p.mid !== null)) {
+        // The server confirmed a mid we never issued while we have mutations in
+        // flight on this domain — two writers on one clientID or corrupted state. Unrecoverable.
+        throw new Error(
+          `optimistic backend: confirmed lmid ${lmid} is ahead of issued mids (${highestIssued})`,
+        );
+      }
+      // A fresh session over a clientID with history: adopt the server's high-water
+      // mark so our next mid continues the sequence instead of colliding below it.
+      this.nextMid.set(domain, lmid + 1);
+    }
+    this.watermark.set(domain, Math.max(this.watermark.get(domain) ?? 0, lmid));
+  }
+
+  // --- the §4 lifecycle system-stream folds (Slice I-iii) --------------------------------
+
+  /** Fold one release's SYSTEM frames in a FIXED category order — the order is STRUCTURAL (one
+   *  function, categories in sequence), because it is the client half of THE NAMED INVARIANT
+   *  (§3.3's shipped note; documented above {@link handleMutationOutcome}): **never retire a
+   *  room-domain entry off a daemon-carried lmid without outcome resolution.**
+   *
+   *    1. **outcome rows** (`_rindle_room_mutation_outcomes`) — each row for OUR clientID is
+   *       synthesized into a {@link MutationOutcomeFrame} and routed through
+   *       {@link handleMutationOutcome}, the SAME H-v state machine the room socket's frames use
+   *       (one verdict path: frames and rows cannot drift). A deopt flips its pending entry to
+   *       the daemon IN PLACE (keep-seq, deal-and-send-now); a rejection surfaces + stays for the
+   *       ordinary burnt-mid retire; a duplicate (frame already seen, or the row re-delivered) is
+   *       absorbed by the processed set — which doubles as the resolved-verdict memory across
+   *       releases (per-domain FIFO, {@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}, mirroring the
+   *       shell's recorded-outcome cap).
+   *    2. **room-ledger rows** (`_rindle_room_client_mutations`) — the FIRST daemon-carried
+   *       room-lmid path: OUR row's `last_mutation_id` folds into `watermark[room:<doc>]` via
+   *       {@link foldConfirm}. Because step 1 ALREADY resolved every non-applied verdict this
+   *       release carries (and earlier releases' verdicts were resolved at their own release),
+   *       the confirm-drop that follows in {@link applyRelease} retires only entries whose
+   *       outcome is resolution-by-absence — which I-ii's co-commit atomicity defines as APPLIED
+   *       (a room flush co-commits the ledger row and every non-applied mid's outcome row in ONE
+   *       daemon transaction, so a covering lmid without a row IS the applied verdict).
+   *       Processing this category before step 1 is the violation, in two proven directions
+   *       (each run break→fail→revert against `test/system_streams.test.ts`): (a) the ledger's
+   *       fresh-session `nextMid` ADOPTION must not run before historical outcome rows are
+   *       judged — adopted-first, a previous session's retained deopt row passes the
+   *       "never-issued" guard and spuriously re-invokes a mutation that session already handled
+   *       (a double-apply); (b) the RETIRE must not precede resolution — it does not BECAUSE the
+   *       confirm-drop runs in {@link applyRelease}, strictly after this whole function. That
+   *       deferral is load-bearing: an "optimization" retiring inline with the watermark fold
+   *       retires a deopted entry as a silent success (the exact lost-write H-v exists to
+   *       prevent) and mis-attributes a rejected row's reason.
+   *    3. **watermark rows** (`_rindle_room_watermark`) — the §4.2 fence value, max-folded per
+   *       doc ({@link roomWatermarks}); I-v's ghost-drop consumer, no reaction here.
+   *    4. **scope-session rows** (`_rindle_scope_sessions`) — the §4.1 occupancy map
+   *       ({@link scopeSessions}); I-iv's doorbell consumer, no reaction here.
+   *
+   *  Ordinary data ops fold AFTER all of these (the caller's main loop) — outcome/ledger state
+   *  must be in place before {@link applyRelease}'s confirm-drop + reconcile consume the release.
+   *  Every row is filtered against the retain's {@link SystemStreamSpec} scope/doc AND (for the
+   *  client-keyed tables) our own `clientID` — defense in depth: the server predicate may have
+   *  been minted doc-only (no `clientId` at lease time), so other clients' rows are expected and
+   *  must be ignored, and a row for a doc this retain was not minted for is never folded.
+   *
+   *  Returns the scopes category 4 touched (snapshot or ops) — the I-iv doorbell events' input;
+   *  `null` when none (every non-lifecycle release). The events themselves fire from
+   *  `onGateProgress` AFTER the release applies, never from inside the fold. */
+  private foldSystemFrames(frames: BufferedFrame[]): Set<string> | null {
+    if (frames.length === 0) return null;
+    const byTable = (table: string): { spec: SystemStreamSpec; frame: BufferedFrame }[] =>
+      frames.flatMap((frame) => {
+        const spec = this.systemQids.get(frame.qid);
+        return spec !== undefined && spec.table === table ? [{ spec, frame }] : [];
+      });
+    // (1) outcome rows → the H-v machine, BEFORE any ledger fold (the named invariant).
+    for (const { spec, frame } of byTable(ROOM_MUTATION_OUTCOMES_TABLE)) {
+      for (const op of frame.ops) {
+        const cells = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
+        if (!cells) continue; // a remove is retention pruning (mid ≤ lmid − 512), never a verdict
+        const row = decodeOutcomeRow(cells);
+        if (!row || row.clientId !== this.clientID) continue;
+        if (spec.doc !== undefined && row.doc !== spec.doc) continue;
+        const frameShape: MutationOutcomeFrame = {
+          mid: row.mid,
+          kind: row.kind,
+          ...(row.reason !== undefined ? { reason: row.reason } : {}),
+          ...(row.name !== undefined ? { name: row.name } : {}),
+          ...(row.args !== undefined ? { args: row.args } : {}),
+        };
+        // Release-time invocation is sound here where out-of-band was REQUIRED for the socket
+        // frames (`attachGate`): the socket frame races a buffered lmid ack it must beat, so it
+        // may not wait behind the gate — a ROW cannot race its own release (it and the covering
+        // ledger row co-committed at one cv and fold in THIS function's fixed order). The
+        // machine's steps need nothing from an open release: the flip/reject only move pending
+        // bookkeeping + ship an envelope, and the not-found re-invoke arm runs a fresh prediction
+        // — legal before `applyRelease` opens the reconcile cycle, identical to an app invoke
+        // racing the release.
+        this.handleMutationOutcome(roomDomainKey(row.doc), frameShape);
+      }
+    }
+    // (2) room-ledger rows → the daemon-carried per-domain confirm (outcomes above resolved first).
+    for (const { spec, frame } of byTable(ROOM_CLIENT_MUTATIONS_TABLE)) {
+      for (const op of frame.ops) {
+        const cells = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
+        if (!cells) continue; // a ledger remove confirms nothing (mirrors foldLmidOps)
+        const [doc, clientId, lmid] = cells;
+        if (typeof doc !== "string" || clientId !== this.clientID) continue;
+        if (spec.doc !== undefined && doc !== spec.doc) continue;
+        const covered = Number(lmid);
+        this.foldConfirm(roomDomainKey(doc), covered);
+        // The §301 direction-A fence input: the DAEMON-CARRIED ledger fold ALONE (the room
+        // socket's own lmid stream confirms long before the flush reaches the daemon, so it
+        // folds the shared watermark above but never this map — 301 §1.1). Max-fold: ledger
+        // rows re-deliver across re-hydrates.
+        if (Number.isFinite(covered)) {
+          const dom = roomDomainKey(doc);
+          this.daemonCarriedLmid.set(dom, Math.max(this.daemonCarriedLmid.get(dom) ?? 0, covered));
+        }
+      }
+    }
+    // (3) watermark rows → the monotone §4.2 fence value per doc.
+    for (const { spec, frame } of byTable(ROOM_WATERMARK_TABLE)) {
+      for (const op of frame.ops) {
+        const cells = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
+        if (!cells) continue; // the fence is monotone — a remove never regresses it
+        const [doc, flushSeq] = cells;
+        const seq = Number(flushSeq);
+        if (typeof doc !== "string" || !Number.isFinite(seq)) continue;
+        if (spec.doc !== undefined && doc !== spec.doc) continue;
+        this.roomWatermarks.set(doc, Math.max(this.roomWatermarks.get(doc) ?? 0, seq));
+      }
+    }
+    // (4) scope-session rows → the §4.1 occupancy map (a snapshot REPLACES the scope's map — an
+    // authoritative re-hydrate must drop sessions that aged out while the stream was down; a
+    // batch folds add/edit/remove incrementally). Touched scopes are collected for the I-iv
+    // doorbell events (a snapshot touches its minted scope even with zero ops — an emptied-out
+    // scope is a legitimate 1→0 observation for the transition tracker).
+    let touchedScopes: Set<string> | null = null;
+    const touch = (scope: string): void => {
+      (touchedScopes ??= new Set()).add(scope);
+    };
+    for (const { spec, frame } of byTable(SCOPE_SESSIONS_TABLE)) {
+      if (frame.kind === "snapshot" && spec.scope !== undefined) {
+        this.scopeSessions.set(spec.scope, new Map());
+        touch(spec.scope);
+      }
+      for (const op of frame.ops) {
+        // A remove's identity rides its (full) removed row; add/edit carry the post-image.
+        const cells = op.op === "edit" ? op.new : op.row;
+        const [scope, clientId, expiresAt] = cells;
+        if (typeof scope !== "string" || typeof clientId !== "string") continue;
+        if (spec.scope !== undefined && scope !== spec.scope) continue;
+        let sessions = this.scopeSessions.get(scope);
+        if (!sessions) this.scopeSessions.set(scope, (sessions = new Map()));
+        if (op.op === "remove") {
+          sessions.delete(clientId);
+        } else {
+          const exp = Number(expiresAt);
+          if (Number.isFinite(exp)) sessions.set(clientId, exp);
         }
-        // A fresh session over a clientID with history: adopt the server's high-water
-        // mark so our next mid continues the sequence instead of colliding below it.
-        this.nextMid = lmid + 1;
+        touch(scope);
       }
-      this.confirmedLmid = Math.max(this.confirmedLmid, lmid);
     }
+    return touchedScopes;
+  }
+
+  /** The I-iv occupancy count — THE one rule (§4.1/D7): unexpired (`expires_at >` the fold
+   *  clock's now) sessions under `scope` from OTHER clientIDs. Shared by the doorbell events
+   *  ({@link onGateProgress}) and the client's registration-time check (a doorbell that folded
+   *  BEFORE a candidate registered must still be able to trigger it) so the two can never
+   *  disagree. Own-clientID rows never count — a solo client cannot ring its own bell — and
+   *  expiry is judged on the injectable {@link FoldClock} (deterministic in a virtual-clock
+   *  harness, the folded-oracle discipline). */
+  otherScopeSessions(scope: string): number {
+    const sessions = this.scopeSessions.get(scope);
+    if (!sessions) return 0;
+    const now = this.clock.now();
+    let n = 0;
+    for (const [clientId, expiresAt] of sessions) {
+      if (clientId !== this.clientID && expiresAt > now) n++;
+    }
+    return n;
+  }
+
+  /** Register the I-iv doorbell event sink — see {@link ScopeSessionsEvent}. One handler (a later
+   *  registration replaces it, the {@link onLocalWrite} convention); client.ts is the consumer. */
+  onScopeSessions(handler: (event: ScopeSessionsEvent) => void): void {
+    this.scopeSessionsHandler = handler;
   }
 
   /** One §1.3 reconcile cycle: rewind the optimistic layer and fold the coherent SERVER
@@ -1079,34 +3023,58 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
    *  deliver the coalesced result (`serverBatchEnd`). This is the engine's only sync-moving
    *  boundary — `onProgress` releases and `unregisterQuery`'s GC both go through here so head
    *  and sync never diverge (the §1.2 invariant; CRIT#2). */
-  private runReconcileCycle(serverDeltas: Mutation[]): void {
-    this.local.serverBatchBegin(serverDeltas.map(toServerOp));
-    // The rewind cleared every optimistic write — incl. prior `__agg` edits — so head is now
-    // the server baseline. Rebuild the optimistic agg delta from scratch off the re-invoked
-    // (confirm-filtered) pending set, so a just-confirmed mutation's delta vanishes exactly as
-    // its server count is absorbed (§5 watermark — no double count).
-    this.overlay.reset();
-    // Re-invoke in WIRE order: assigned mids ascending, then unflushed folds (`mid == null`) last
-    // by creation order — the deterministic slot of FOLDED-MUTATIONS-DESIGN §4.1. A read-dependent
-    // mutator must replay against the same base the server computed from, which is mid order; with
-    // deferred fold mids, mid order ≠ creation order, so we sort rather than trust array order. The
-    // comparator is explicit (NOT `(mid ?? ∞) - (mid ?? ∞)`, which is `∞ - ∞ = NaN` for two unflushed
-    // folds — a NaN comparator silently corrupts V8's sort): assigned-before-unflushed, mids
-    // ascending, and STABLE for two unflushed folds so they keep creation order across cycles.
-    const order = [...this.pendingMutations].sort((a, b) => {
-      if (a.mid === null && b.mid === null) return 0; // both unflushed → stable creation order
-      if (a.mid === null) return 1; // an unflushed fold sorts after every assigned mid
-      if (b.mid === null) return -1;
-      return a.mid - b.mid;
-    });
+  private runReconcileCycle(sourceKey: string, serverDeltas: Mutation[]): void {
+    // `sourceKey` names the authority these `deltas` confirm — `"daemon"` on the live daemon path (and
+    // the GC path), a `room:doc:X` string on a per-source release (E-iii). It selects which physical
+    // source the wasm engine's rewind folds the delta into (`Db::serverBatchBegin`). The E-iii-b/c
+    // per-source rewind + intersecting-pending re-invoke filter ride the same seam later.
+    this.local.serverBatchBegin(sourceKey, serverDeltas.map(toServerOp));
+    // The aggregate overlay (§4) is DAEMON-tracked: its `__agg_*` tables are server-authoritative
+    // synthetic tables that only the daemon feed drives. A room cycle must not wipe or rebuild it
+    // (that would double-count / lose daemon agg state), so gate every overlay interaction — reset,
+    // observe, and reconcileAggHead — on the daemon cycle. Single-domain: always daemon ⇒ unchanged.
+    const daemonCycle = sourceKey === "daemon";
+    if (daemonCycle) {
+      // The rewind cleared every optimistic write — incl. prior `__agg` edits — so head is now the
+      // server baseline. Rebuild the optimistic agg delta from scratch off the re-invoked
+      // (confirm-filtered) pending set, so a just-confirmed mutation's delta vanishes exactly as its
+      // server count is absorbed (§5 watermark — no double count).
+      this.overlay.reset();
+    }
+    // Sort ALL pending into SEND order (the client-global `seq` ascending, then unflushed folds
+    // last by creation order — the deterministic §4.1 slot; the comparator is explicit, NOT
+    // `(seq ?? ∞) - (seq ?? ∞)` which is `∞ - ∞ = NaN` and corrupts V8's sort), THEN FILTER to the
+    // writers of THIS source (§5.3): a per-source rewind un-applied ONLY that source's staged
+    // writes, so ONLY those must re-invoke — the others' predictions are intact on their un-rewound
+    // trees. The key MUST be `seq`, never `mid`: mids are per-domain (§7.1) so mids from different
+    // domains are incomparable — a mid-sort would replay a room mid 1 before a daemon mid 5 that
+    // was sent FIRST, letting a read-dependent mutator re-predict from a base it never saw
+    // (confirmation order is per-domain; replay order is client-global). FILTERING the
+    // globally-ordered array preserves the relative send order among the subset (the 200 §4.1
+    // invariant); NEVER re-sort the subset. Single-domain: every entry has
+    // `touchedSources = {"daemon"}` and seq order == mid order (except H-v deopt re-enqueues,
+    // which keep their ORIGINAL seq under a later daemon mid — deliberately, so this very sort
+    // replays them at their original overlay position) ⇒ byte-identical to before.
+    const order = [...this.pendingMutations]
+      .sort((a, b) => {
+        if (a.seq === null && b.seq === null) return 0; // both unflushed → stable creation order
+        if (a.seq === null) return 1; // an unflushed fold sorts after every dealt seq
+        if (b.seq === null) return -1;
+        return a.seq - b.seq;
+      })
+      .filter((p) => p.touchedSources.has(sourceKey));
     const dropped = new Set<PendingMutation>();
     try {
       for (const p of order) {
-        const touched = new Set<string>();
+        // NO `readLog` here — recording is armed only on the initial `invoke` (§3.2 #2 note on
+        // `PendingMutation.reads`); a re-invocation's write-set still needs fresh capture (below).
+        const writes: WriteSet = new Map();
         const ops: ChildOp[] = [];
+        const stagedKeys: string[] = [];
+        let sources: string[] = [];
         try {
-          this.local.writeWith((tx) => {
-            this.runMutator(this.registry[p.name], trackingTx(tx, touched, this.specs, this.localTables, this.opCollector(ops)), p.args);
+          sources = this.local.writeWith((tx) => {
+            this.runMutator(this.registry[p.name], trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, undefined, stagedKeys), p.args);
           });
         } catch {
           // A re-invocation threw — e.g. a read-dependent mutator whose base row the server
@@ -1118,50 +3086,65 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
           dropped.add(p);
           continue;
         }
-        // The re-invocation stuck — fold its child ops into the rebuilt optimistic agg delta.
-        for (const op of ops) this.overlay.observe(op);
+        // The re-invocation stuck — fold its child ops into the rebuilt optimistic agg delta (daemon
+        // cycle only — a room cycle leaves the daemon-tracked overlay untouched).
+        if (daemonCycle) for (const op of ops) this.overlay.observe(op);
         // The pending footprint is the UNION across invocations: a re-run that no-ops (touched =
         // {}) must NOT shrink it, else a still-pending mutation reports not-pending and its
-        // pending-axis clear fires early (§7.2).
-        for (const t of touched) p.touched.add(t);
+        // pending-axis clear fires early (§7.2). `writes`/the source axes mirror this: merge, never
+        // replace. (A re-invocation may route differently, e.g. onto a source the room feed now
+        // holds — union so the filter still catches it on either source's next cycle.)
+        for (const t of writes.keys()) p.touched.add(t);
+        mergeWriteSet(p.writes, writes);
+        for (const s of sources) p.touchedSources.add(s);
+        mergeWriteSources(p.writeSources, stagedKeys, sources);
       }
       // Preserve creation order in the live array (the unflushed-fold sort tiebreak depends on it).
       if (dropped.size) this.pendingMutations = this.pendingMutations.filter((p) => !dropped.has(p));
       // Re-apply the optimistic agg delta onto the (rewound) `__agg` head rows — INSIDE the open
       // cycle, so the writes buffer and coalesce into the one per-query delivery `serverBatchEnd`
-      // makes (and never escape as a separate batch).
-      this.reconcileAggHead();
+      // makes (and never escape as a separate batch). Daemon cycle only (see above).
+      if (daemonCycle) this.reconcileAggHead();
     } finally {
       this.local.serverBatchEnd(); // ALWAYS close the cycle — ONE delivery per affected query.
     }
   }
 
-  /** The daemon restarted (a new boot id): it lost all materialization + `cv` state and its `cv`
-   *  sequence reset, so previously-released `cv`s no longer bound the new stream. The source has
-   *  already re-subscribed every query (reconnect → resync); drop the buffer and the `cv`
-   *  watermark so the fresh, low-`cv` snapshots are RELEASED instead of dropped as stale
-   *  (`onNormalized`/`onProgress` gate on `appliedCv`). Pending optimistic mutations stay put —
-   *  they re-apply on the next reconcile, and the lmid system query's fresh snapshot restores the
-   *  confirmation watermark. */
-  private resetForRestart(): void {
-    this.buffer = [];
-    this.appliedCv = 0;
+  /** ONE channel's authority restarted (a new boot id): it lost all materialization + `cv` state
+   *  and its `cv` sequence reset, so previously-released `cv`s no longer bound the new stream. The
+   *  source has already re-subscribed every query (reconnect → resync); drop THIS gate's buffer
+   *  and `cv` watermark so the fresh, low-`cv` snapshots are RELEASED instead of dropped as stale
+   *  (`onFrame`/`computeRelease` gate on `appliedCv`). The OTHER gates are untouched — an
+   *  authority restart is per-channel (§5.1). Pending optimistic mutations stay put — they
+   *  re-apply on the next reconcile, and the channel's lmid system query's fresh snapshot restores
+   *  its domain's confirmation watermark. */
+  private resetGate(gate: SourceGate): void {
+    gate.buffer = [];
+    gate.appliedCv = 0;
+    // The §301 upstream-absorption advert dies with the incarnation that made it — the fresh
+    // one re-advertises (direction-B pins conservatively hold until it does).
+    delete gate.upstreamBoot;
+    delete gate.upstreamCv;
   }
 
-  /** The §8.5 escape: the buffer outgrew its cap (a pinned `cvMin` under churn). Drop
-   *  everything buffered and re-register every query on the source — the fresh
-   *  snapshots arrive as ordinary frames and the next release re-hydrates via the
-   *  footprint diff (the §5.3 path); still-pending optimism re-applies in that cycle. */
-  private overflow(): void {
-    this.buffer = [];
+  /** The §8.5 escape: ONE gate's buffer outgrew its cap (a pinned `cvMin` under churn on that
+   *  channel). Drop everything it buffered and re-register every query on that source — the fresh
+   *  snapshots arrive as ordinary frames and the next release re-hydrates via the footprint diff
+   *  (the §5.3 path); still-pending optimism re-applies in that cycle. The other gates' buffers
+   *  and subscriptions are untouched. */
+  private overflow(gate: SourceGate): void {
+    gate.buffer = [];
     for (const sub of this.remoteSubs.values()) {
-      this.source.unregisterQuery(sub.sourceQid);
-      this.source.registerQuery(sub.sourceQid, sub.remote);
+      // Re-register only the subs THIS channel owns ({@link RemoteSub.channel} — the one source
+      // of truth, G-iii): resubscribing another channel's sub here would fork its stream.
+      if (sub.channel !== gate.key) continue;
+      gate.source.unregisterQuery(sub.sourceQid);
+      gate.source.registerQuery(sub.sourceQid, sub.remote);
     }
     // The lmid system query's buffered frames were dropped too — re-subscribe it so a
     // fresh snapshot restores the confirmation watermark.
-    this.source.unregisterQuery(LMID_QID);
-    this.source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
+    gate.source.unregisterQuery(LMID_QID);
+    gate.source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
   }
 
   private setResultType(qid: QueryId, rt: ResultType): void {
@@ -1191,15 +3174,30 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     }
   }
 
-  private retainRemote(retainQid: QueryId, remote: RemoteQuery, localQueryId: QueryId | undefined = retainQid): void {
+  /** `channel` (G-iii registration-time routing): the gate the sub registers on — the qid's
+   *  ownership is fixed HERE, at retain time (no lazy claim; `onFrame` only asserts it). Default
+   *  `"daemon"`, so every channel-less caller is byte-identical to before. */
+  private retainRemote(
+    retainQid: QueryId,
+    remote: RemoteQuery,
+    localQueryId: QueryId | undefined = retainQid,
+    channel = "daemon",
+  ): void {
+    const gate = this.requireGate(channel); // throw loudly BEFORE any sub state moves
     const key = remoteKey(remote);
     let sub = this.remoteSubs.get(key);
     let isNew = false;
     if (!sub) {
-      sub = { sourceQid: retainQid, remote, refCount: 0, localQids: new Map(), hydrated: false };
+      sub = { sourceQid: retainQid, remote, refCount: 0, localQids: new Map(), hydrated: false, channel };
       this.remoteSubs.set(key, sub);
       this.sourceToRemote.set(sub.sourceQid, key);
       isNew = true;
+    } else if (sub.channel !== channel) {
+      // A (name,args) sub lives on ONE channel — a second retain naming another is a wiring bug
+      // (it would split the query's frames across two cv timelines). Fail loudly.
+      throw new Error(
+        `optimistic backend: query "${remote.name}" is already retained on channel ${JSON.stringify(sub.channel)} — cannot retain it on ${JSON.stringify(channel)}`,
+      );
     }
     sub.refCount++;
     if (localQueryId !== undefined) {
@@ -1213,7 +3211,9 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     }
     this.localToRemote.set(retainQid, key);
     this.remoteRetainToLocal.set(retainQid, localQueryId);
-    if (isNew) this.source.registerQuery(sub.sourceQid, remote);
+    // Register on the CHANNEL's source (G-iii): the qid's frames will arrive — and buffer, release,
+    // and overflow — on that channel's own §5.1 gate.
+    if (isNew) gate.source.registerQuery(sub.sourceQid, remote);
   }
 
   private releaseRemote(retainQid: QueryId): QueryId | undefined {
@@ -1231,7 +3231,10 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
       else sub.localQids.delete(localQueryId);
     }
     if (sub.refCount > 0) return undefined;
-    this.source.unregisterQuery(sub.sourceQid);
+    // Unregister from the SAME gate's source the retain registered on. Since I-v a gate CAN be
+    // removed ({@link disconnectSource}) — but never with a live sub on it ({@link
+    // demoteRoomSource} validates loudly), so the daemon fallback is purely defensive.
+    (this.gates.get(sub.channel) ?? this.daemonGate).source.unregisterQuery(sub.sourceQid);
     this.sourceToRemote.delete(sub.sourceQid);
     this.remoteSubs.delete(key);
     return sub.sourceQid;
@@ -1266,6 +3269,11 @@ interface RemoteSub {
   localQids: Map<QueryId, number>;
   /** Whether this sub's first server snapshot has been released (drives hydration of its views). */
   hydrated: boolean;
+  /** The authority channel (gate/source key) this sub registered on — fixed at retain time
+   *  (G-iii registration-time routing), `"daemon"` unless a channel-keyed retain named another.
+   *  The ONE source of truth for qid→channel ownership: `onFrame`'s wrong-channel assertion and
+   *  the per-gate `overflow` both read it (via {@link OptimisticBackend.channelOf} / directly). */
+  channel: string;
 }
 
 function remoteKey(remote: RemoteQuery): string {
@@ -1325,18 +3333,140 @@ function colIndexFromSchema<S extends ColsMap>(schema: Schema<S>): Record<string
   return out;
 }
 
-/** Wrap the raw wasm txn as the client `MutationTx`, recording the touched tables (the client
- *  knows its own footprint — what the pending axis derives from, §7.2). The keyed methods validate
- *  column names eagerly: a typo'd table or column throws with the valid names listed, at the moment
- *  the mutator runs.
+/** Merge a fresh invocation's write-set into a `PendingMutation`'s accumulated one (§3.2 #1, rebase
+ *  re-invocation): each pk's value is OVERWRITTEN with the newest image (a later invocation ran
+ *  against the base the rebase just replaced, so its view supersedes the earlier one), but a key
+ *  present only in `dest` is left alone — the same union-never-shrink rule `touched` already
+ *  follows (§7.2: "a re-run that no-ops must NOT shrink it"). */
+function mergeWriteSet(dest: WriteSet, src: WriteSet): void {
+  for (const [table, byPk] of src) {
+    let d = dest.get(table);
+    if (!d) dest.set(table, (d = new Map()));
+    for (const [pkKey, rec] of byPk) d.set(pkKey, rec);
+  }
+}
+
+/** The key a per-pk write source is stored under in {@link PendingMutation.writeSources}: `table`
+ *  + NUL + the pk-key (`stableJson(pk)`). NUL appears in neither a table name nor `stableJson`
+ *  output, so it is an unambiguous separator — the same key the confirm-drop hold-back reconstructs
+ *  from `(table, pkKey)` while iterating `writes`. */
+function writeSourceKey(table: string, pkKey: string): string {
+  return `${table}\u0000${pkKey}`;
+}
+
+/** Zip the staged-order per-write source keys (`stagedKeys`, from `trackingTx`) with the staged-order
+ *  `sources[]` (`commitTracked`) into `dest`, last-write-per-key winning (§5.3). Never shrinks `dest`
+ *  — a rebase re-invocation MERGES its fresh routing in, mirroring {@link mergeWriteSet}. The two
+ *  arrays align 1:1: `trackingTx` pushes exactly one key per staged change, and `commitTracked`
+ *  returns one source per staged change, both in staged order. */
+function mergeWriteSources(dest: Map<string, string>, stagedKeys: string[], sources: string[]): void {
+  const n = Math.min(stagedKeys.length, sources.length);
+  for (let i = 0; i < n; i++) dest.set(stagedKeys[i], sources[i]);
+}
+
+// --- the §3 router's pure helpers (H-iii) --------------------------------------------
+
+/** STRICT cell identity for the join-key no-change rule (§3 write rule #3): `===`, nothing more —
+ *  no coercion, no deep equality (a non-primitive join-key cell compares by reference and thus
+ *  conservatively fails), `NaN !== NaN` conservatively fails. Failing closed here only costs a
+ *  daemon route. */
+function identicalCell(a: WireValue, b: WireValue): boolean {
+  return a === b;
+}
+
+/** Whether `cond` is decidable from the KEY ALONE: every column it references — collected from
+ *  BOTH operand positions (under-counting could over-claim decidability; over-counting only fails
+ *  closed — the H-iv-a discipline) — is a pk column. A `correlatedSubquery` is never key-local. */
+// Exported for test/predicate_agreement.test.ts — the TS corner of the cross-evaluator
+// agreement corpus (rust/rindle-room-core/tests/fixtures/predicate-agreement.json). NOT part of
+// the package surface (index.ts curates exports); the corpus is the drift tripwire that keeps
+// this evaluator honest against the engine + room-gate pair it shares no code with.
+export function keyDecidable(cond: Condition, pkCols: ReadonlySet<string>): boolean {
+  switch (cond.type) {
+    case "simple": {
+      if (cond.left.type === "column" && !pkCols.has(cond.left.name)) return false;
+      if (cond.right.type === "column" && !pkCols.has(cond.right.name)) return false;
+      return true;
+    }
+    case "and":
+    case "or":
+      return cond.conditions.every((c) => keyDecidable(c, pkCols));
+    case "correlatedSubquery":
+      return false;
+  }
+}
+
+/** Evaluate a key-decidable `footprintWhere` on a read's pk cells — H-iii's ONE client-side
+ *  non-engine evaluator, DELIBERATELY MINIMAL (the TS evaluation caveat on the router block
+ *  comment): `simple` `=`/`!=` between a pk COLUMN and a same-primitive-type NON-NULL literal,
+ *  composed under and/or. The empty AND — the compiler's vacuous-true emission for an exact
+ *  unconstrained footprint root — evaluates `true` (load-bearing: whole-table footprints keep
+ *  provable reads); the empty OR is vacuous-false. Returns `undefined` = NOT EVALUABLE for
+ *  anything else (other ops, null on either side, cross-type comparisons, column-vs-column,
+ *  literal-vs-literal, non-primitive cells, correlated subqueries) — the caller fails to the
+ *  daemon. A non-evaluable node anywhere poisons the whole tree (no short-circuit past it):
+ *  partial evaluation could otherwise claim a verdict the engine's semantics might contradict. */
+// Exported for test/predicate_agreement.test.ts (see keyDecidable's note above).
+export function evalFootprintOnPk(cond: Condition, pkCells: ReadonlyMap<string, WireValue>): boolean | undefined {
+  switch (cond.type) {
+    case "simple": {
+      if (cond.op !== "=" && cond.op !== "!=") return undefined;
+      const col = cond.left.type === "column" ? cond.left : cond.right.type === "column" ? cond.right : undefined;
+      const lit = cond.left.type === "literal" ? cond.left : cond.right.type === "literal" ? cond.right : undefined;
+      if (col === undefined || lit === undefined) return undefined; // column-vs-column / literal-vs-literal
+      if (!pkCells.has(col.name)) return undefined; // not a pk column (keyDecidable pre-screens)
+      const cell = pkCells.get(col.name);
+      const value = lit.value;
+      if (cell === null || value === null) return undefined; // no null semantics client-side
+      if (typeof cell !== typeof value) return undefined; // no cross-type comparison semantics
+      if (typeof cell !== "string" && typeof cell !== "number" && typeof cell !== "boolean") return undefined;
+      return cond.op === "=" ? cell === value : cell !== value;
+    }
+    case "and": {
+      let out = true;
+      for (const c of cond.conditions) {
+        const v = evalFootprintOnPk(c, pkCells);
+        if (v === undefined) return undefined;
+        out = out && v;
+      }
+      return out;
+    }
+    case "or": {
+      let out = false;
+      for (const c of cond.conditions) {
+        const v = evalFootprintOnPk(c, pkCells);
+        if (v === undefined) return undefined;
+        out = out || v;
+      }
+      return out;
+    }
+    case "correlatedSubquery":
+      return undefined;
+  }
+}
+
+/** Wrap the raw wasm txn as the client `MutationTx`, capturing a pk-granular write-set as it
+ *  applies (`writes`, a {@link WriteSet} — table → pk-key → last-write-wins image, §3.2 #1);
+ *  `touched` (the pending axis's table-granular Set, §7.2) is derived by the CALLER as
+ *  `new Set(writes.keys())`, never populated here. The keyed methods validate column names eagerly:
+ *  a typo'd table or column throws with the valid names listed, at the moment the mutator runs.
  *
- *  With `trapReads` (the FOLDED path, §5), the PUBLIC reads `tx.get`/`tx.row` throw `FoldReadError`
- *  — a folded mutator that reads state to compute its write is non-absorbing and refused. The keyed
- *  writers (`update`/`upsert`/`delete`) still read internally to preserve unspecified columns; that
- *  is column-preservation, not value-derivation, so it stays allowed. */
+ *  With `trapReads` (the FOLDED path, §5), the PUBLIC reads `tx.get`/`tx.row`/`tx.query` throw
+ *  `FoldReadError` — a folded mutator that reads state to compute its write is non-absorbing and
+ *  refused. The keyed writers (`update`/`upsert`/`insertIgnore`/`delete`) still read internally to
+ *  preserve unspecified columns / check pre-existence; that is fold-legal (the trap wraps only the
+ *  returned object's `get`/`row`/`query` surface, never the writers' internal probe) — unchanged
+ *  by H-ii, which records those probes but arms recording only where the trap never is.
+ *
+ *  With `readLog` (recording mode, RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §3.2 #2) — a SIBLING
+ *  of `trapReads`, the two never armed together by any call site — the PUBLIC `tx.get`/`tx.row`
+ *  push a `(table, pk, outcome, source?)` {@link ReadRecord} (per-read provenance via the
+ *  `provenance` probe, H-ii §3.2 #3), `tx.query` pushes its resolved AST, and (H-ii) the keyed
+ *  writers' pre-existence probes record through the same path. Pure capture: it changes no return
+ *  value, throws nothing, and is a no-op when `readLog` is omitted. */
 /** Apply one logical {@link MutationOp} (yielded by a shared generator mutator) onto the client's
  *  keyed {@link MutationTx} — the same methods a plain client mutator calls directly. Column
- *  validation, touched-table tracking, and op collection all happen inside those methods. */
+ *  validation, write-set capture, and op collection all happen inside those methods. */
 function applyOpToTx(tx: MutationTx, op: MutationOp): void {
   switch (op.kind) {
     case "insert":
@@ -1354,11 +3484,17 @@ function applyOpToTx(tx: MutationTx, op: MutationOp): void {
 
 function trackingTx(
   tx: WasmWriteTxn,
-  touched: Set<string>,
+  writes: WriteSet,
   specs: TableSpecs,
   localTables: Set<string>,
   onOp?: (op: ChildOp) => void,
   trapReads = false,
+  readLog?: ReadLog,
+  stagedKeys?: string[],
+  /** Per-read provenance probe (H-ii §3.2 #3): called once per RECORDED present read with the
+   *  full-width row the read observed; meaningful only alongside `readLog` (never consulted when
+   *  recording is off — the fold and replay paths pass neither). */
+  provenance?: (table: string, row: WireValue[]) => string | undefined,
 ): MutationTx {
   const spec = (table: string) => {
     const s = specs[table];
@@ -1401,6 +3537,28 @@ function trackingTx(
   const pkCells = (table: string, obj: KeyedRow): WireValue[] =>
     spec(table).primaryKey.map((i) => obj[spec(table).columns[i]]);
 
+  // pk from the POSITIONAL wire shape (raw cells in schema column order) — the counterpart of
+  // `pkCells` (which reads a KeyedRow) for the raw `add`/`remove`/`edit` writers below (§3.2 #1).
+  const pkFromCells = (table: string, cells: WireValue[]): WireValue[] =>
+    spec(table).primaryKey.map((i) => cells[i]);
+
+  // Record (or overwrite) this pk's write for the invocation (§3.2 #1): last-write-wins WITHIN
+  // this invocation — an add-then-edit (or edit-then-edit) of the same pk collapses to its final
+  // image, matching the engine head's own semantics for that pk. The record is replaced with
+  // exactly the arguments given: the CALLERS (`edit`/`remove` below, consulting `prior`) decide
+  // the pre-image per the H-ii coalescing matrix on {@link WriteRecord}.
+  const recordWrite = (table: string, pk: WireValue[], row: WireValue[] | undefined, oldRow?: WireValue[]): void => {
+    let byPk = writes.get(table);
+    if (!byPk) writes.set(table, (byPk = new Map()));
+    const pkKey = stableJson(pk);
+    // Defensive copies: the wasm binding's returned arrays are not contractually immutable/unique,
+    // so a captured record must not alias a cell array the engine could later reuse or mutate.
+    byPk.set(pkKey, { table, pk: [...pk], row: row ? [...row] : undefined, ...(oldRow ? { oldRow: [...oldRow] } : {}) });
+    // Staged-order key trace (§5.3): pushed once per staged change, so it zips 1:1 with the staged
+    // order of `commitTracked`'s `sources[]` — letting the caller learn each write's routed source.
+    stagedKeys?.push(writeSourceKey(table, pkKey));
+  };
+
   // A full insert row: each cell is `obj[c]`, or `null` for an omitted nullable column (design 206
   // §6.2); a `json` object is stringified for the engine (`toCell`). Non-nullable columns are
   // guaranteed present by `checkColumns(full)`.
@@ -1415,27 +3573,102 @@ function trackingTx(
     return out;
   };
 
-  // Internal read — used by the keyed writers below and the keyed `row` reader; never trapped (for
-  // the FOLD trap) but ALWAYS guarded against local reads (M1).
+  // The raw, UN-recorded read primitive behind `getImpl`/`rowImpl` — the M1 local guard + the txn
+  // read, nothing else. Slice B deliberately kept the keyed writers (`update`/`upsert`/
+  // `insertIgnore`/`delete`) on this, un-recorded ("recording is about the PUBLIC read entry
+  // points"). H-ii deliberately REVERSES that: the pre-existence probe each keyed writer BRANCHES
+  // on is genuine value-dependence the §3 routing proof must see — the concrete silent-drop shape
+  // is `update("cards", {id:5,…})` where the client's daemon slice has the row but the room's
+  // footprint lacks it: the room-side update no-ops, the commit "succeeds" with zero effects, the
+  // confirm retires the entry, and the user's edit silently vanishes. The proof can only refuse
+  // that route if the probe is on the record. So the keyed writers now probe through `getImpl`
+  // (recorded like any public read, §3.2 #3); the FOLD trap is unaffected — it wraps only the
+  // returned object's `get`/`row`/`query` surface, so keyed writers stay fold-legal and the
+  // trapped path (where `readLog` is never armed) records nothing, exactly as before.
   const rawGet = (table: string, pk: WireValue[]) => {
     assertNotLocal(table, "read");
     return tx.get(table, pk) as WireValue[] | undefined;
   };
+
+  // Push one {@link ReadRecord} when recording is armed (§3.2 #2/#3): outcome from `row`'s
+  // presence, per-read provenance probed with the observed FULL-WIDTH row — present reads only
+  // (an absent read has no row to probe with, and records no source; see {@link ReadRecord}).
+  // The `source` key is OMITTED (not set to undefined) when there is no answer, so a
+  // single-domain record is byte-identical to Slice B's.
+  const recordRead = (table: string, pk: WireValue[], row: WireValue[] | undefined): void => {
+    if (!readLog) return;
+    const source = row === undefined ? undefined : provenance?.(table, row);
+    readLog.reads.push({
+      table,
+      pk: [...pk],
+      outcome: row === undefined ? "absent" : "present",
+      ...(source !== undefined ? { source } : {}),
+    });
+  };
+
+  // The PUBLIC positional read (§3.2 #2) — and, since H-ii, the keyed writers' pre-existence
+  // probe (§3.2 #3, see the `rawGet` note): `rawGet` plus a `readLog` record when recording is
+  // armed. A no-op record when `readLog` is omitted — exactly `rawGet`'s behavior then.
+  const getImpl = (table: string, pk: WireValue[]): WireValue[] | undefined => {
+    const result = rawGet(table, pk);
+    recordRead(table, pk, result);
+    return result;
+  };
+
+  // The PUBLIC keyed read (§3.2 #2), the `row` counterpart of `getImpl`.
+  const rowImpl = (table: string, pk: KeyedRow): KeyedRow | undefined => {
+    checkColumns(table, pk, false);
+    const pkc = pkCells(table, pk);
+    const cells = rawGet(table, pkc);
+    recordRead(table, pkc, cells);
+    return cells ? toKeyed(table, cells) : undefined;
+  };
+
+  // The pk's existing record from THIS invocation, if any — the coalescing-matrix input for
+  // `edit`/`remove` below (see {@link WriteRecord}).
+  const prior = (table: string, pk: WireValue[]): WriteRecord | undefined =>
+    writes.get(table)?.get(stableJson(pk));
   const add = (table: string, row: WireValue[]) => {
     assertNotLocal(table, "write");
-    touched.add(table);
+    recordWrite(table, pkFromCells(table, row), row);
     onOp?.({ table, kind: "add", row });
     tx.add(table, row);
   };
   const remove = (table: string, row: WireValue[]) => {
     assertNotLocal(table, "write");
-    touched.add(table);
+    const pk = pkFromCells(table, row);
+    // The remove PRE-IMAGE (G-iii, §7.3 tombstone; the H-ii matrix on {@link WriteRecord}):
+    // remove-after-edit/-remove keeps the ORIGINAL captured pre-image (the txn-entry base — the
+    // net effect is a remove of the row the external world last knew, never the edited transient).
+    // Otherwise (first touch, or remove-after-add) the truthful full-width row is the txn-visible
+    // one — `tx.get` read BEFORE the remove stages (read-your-writes: an add of this pk earlier in
+    // the SAME invocation shows through). Captured NOW so Slice H's writable-predicate evaluation
+    // over it needs no migration. Falls back to the caller's asserted `row` when the pk is not
+    // resident (a raw remove of an absent row) — a captured remove thus always carries a
+    // full-width pre-image (the engine width-checks `holdBackAbsent`).
+    const oldRow = prior(table, pk)?.oldRow ?? (tx.get(table, pk) as WireValue[] | undefined) ?? row;
+    recordWrite(table, pk, undefined, oldRow);
     onOp?.({ table, kind: "remove", row });
     tx.remove(table, row);
   };
   const edit = (table: string, oldRow: WireValue[], newRow: WireValue[]) => {
     assertNotLocal(table, "write");
-    touched.add(table);
+    const pk = pkFromCells(table, newRow);
+    // The edit PRE-IMAGE (H-ii; the matrix on {@link WriteRecord}) — H-iii's join-key no-change
+    // input, and the row the engine routes the Edit by (H-i). First touch: the txn-visible row
+    // read BEFORE staging, falling back to the caller's asserted `oldRow` when the pk is not
+    // resident (covers the pk-MOVING raw edit — the record is keyed by the NEW pk; the pre-image
+    // carries the OLD row). Edit-after-edit: keep the FIRST pre-image (the txn-entry base).
+    // Edit-after-add / edit-after-remove: the record collapses to a (re-)insert — NO pre-image
+    // (the pk did not pre-exist this invocation's base).
+    const p = prior(table, pk);
+    const pre =
+      p === undefined
+        ? ((tx.get(table, pk) as WireValue[] | undefined) ?? oldRow)
+        : p.row !== undefined && p.oldRow !== undefined
+          ? p.oldRow
+          : undefined;
+    recordWrite(table, pk, newRow, pre);
     onOp?.({ table, kind: "edit", row: newRow, old: oldRow });
     tx.edit(table, oldRow, newRow);
   };
@@ -1454,29 +3687,28 @@ function trackingTx(
   const runQuery = (q: QueryArg): QueryResultRow[] => {
     const ast = q.ast();
     for (const t of collectTables(ast)) assertNotLocal(t, "read");
+    readLog?.queries.push(ast);
     return tx.query(ast) as QueryResultRow[];
   };
 
   return {
-    get: trapReads ? trapped : rawGet,
+    get: trapReads ? trapped : getImpl,
     query: trapReads ? trapped : runQuery,
     add,
     remove,
     edit,
-    row: trapReads
-      ? trapped
-      : (table, pk) => {
-          checkColumns(table, pk, false);
-          const cells = rawGet(table, pkCells(table, pk));
-          return cells ? toKeyed(table, cells) : undefined;
-        },
+    row: trapReads ? trapped : rowImpl,
     insert: (table, row) => {
       checkColumns(table, row, true);
       add(table, toCells(table, row));
     },
+    // The keyed writers' pre-existence probes go through `getImpl` — RECORDED reads since H-ii
+    // (§3.2 #3): each writer BRANCHES on the probe, a value-dependence the routing proof must see
+    // (the silent-drop rationale on `rawGet` above). Fold-legal exactly as before (the trap wraps
+    // the public surface above, never these), and byte-identical when recording is off.
     update: (table, row) => {
       checkColumns(table, row, false);
-      const current = rawGet(table, pkCells(table, row));
+      const current = getImpl(table, pkCells(table, row));
       if (!current) return; // rebase-friendly: the row may have vanished upstream
       const s = spec(table);
       // Named columns overwrite (a `json` object stringified via `toCell`); unnamed keep `current`,
@@ -1486,17 +3718,17 @@ function trackingTx(
     },
     upsert: (table, row) => {
       checkColumns(table, row, true);
-      const current = rawGet(table, pkCells(table, row));
+      const current = getImpl(table, pkCells(table, row));
       if (current) edit(table, current, toCells(table, row));
       else add(table, toCells(table, row));
     },
     insertIgnore: (table, row) => {
       checkColumns(table, row, true);
-      if (!rawGet(table, pkCells(table, row))) add(table, toCells(table, row));
+      if (!getImpl(table, pkCells(table, row))) add(table, toCells(table, row));
     },
     delete: (table, pk) => {
       checkColumns(table, pk, false);
-      const current = rawGet(table, pkCells(table, pk));
+      const current = getImpl(table, pkCells(table, pk));
       if (!current) return; // rebase-friendly no-op
       remove(table, current);
     },