@rindle/optimistic 0.4.4 → 0.6.3

package/dist/backend.js

@@ -41,6 +41,7 @@ import { CLIENT_MUTATIONS_SCHEMA, driveMutationSync, insertCell, insertPlan, isG
 import { aggTableSchemas, NormalizedSync, rewriteAggregates } from "@rindle/normalized";
 import { WasmBackend } from "@rindle/wasm";
 import { AggOverlay, collectAggDefs } from "./agg-overlay.js";
+import { decodeOutcomeRow, LIFECYCLE_TABLE_SCHEMAS, ROOM_CLIENT_MUTATIONS_TABLE, ROOM_MUTATION_OUTCOMES_TABLE, ROOM_WATERMARK_TABLE, roomDomainKey, SCOPE_SESSIONS_TABLE, } from "./system-streams.js";
 /** The reserved source-qid of the backend's own lmid system query. User/local query ids
  *  are assigned by the `Store` starting at 1, so 0 never collides. */
 const LMID_QID = 0;
@@ -56,6 +57,13 @@ const REAL_CLOCK = {
     clearTimeout: (h) => clearTimeout(h),
     now: () => Date.now(),
 };
+/** The (shared, frozen-by-convention) empty map {@link OptimisticBackend.roomTablesFor} answers
+ *  for a room with no registered tables. */
+const EMPTY_ROOM_TABLES = new Map();
+/** Per-domain retention cap for the processed-outcome set (H-v) — mirrors the shell's
+ *  `MAX_RECORDED_OUTCOMES_PER_CLIENT`: the sender caps what it can re-answer at 512 per client,
+ *  so remembering more than 512 processed mids per domain buys nothing. */
+const MAX_PROCESSED_OUTCOMES_PER_DOMAIN = 512;
 export class OptimisticBackend {
     local;
     sync;
@@ -78,6 +86,9 @@ export class OptimisticBackend {
      *  its width check. */
     colCounts;
     colIndex;
+    /** Per-table pk column indices — held so `connectSource` can build a fresh per-source
+     *  `NormalizedSync` with the same layout the daemon's uses. */
+    pkCols;
     /** The client's OWN typed per-table schemas + the reserved lmid table — the fixed base
      *  of the expected-schema set (CRIT#4 validation). Synthetic agg tables are appended as
      *  queries arrive (`ensureSyntheticTables`). */
@@ -102,6 +113,12 @@ export class OptimisticBackend {
     // only for the duration of the reconcile cycle in `onProgress`; a re-hydrate after a drop is a real
     // footprint diff (genuine change) and is NOT remapped. See {@link ChangeEvent} `catchUp`.
     catchUpQids = null;
+    /** Newly-hydrated qids whose reconcile ACTUALLY emitted a (catch-up-stamped) batch — recorded by the
+     *  local-event forwarder alongside {@link catchUpQids}. After the reconcile, any newly-hydrated qid
+     *  NOT in here folded nothing (0 rows, or its result already present via a sibling → 0 net muts, or
+     *  the reconcile was skipped), so `onProgress` sends it an explicit empty catch-up — else its SSR
+     *  seed would never retire (the view freezes). Non-null only for the reconcile's duration. */
+    catchUpEmitted = null;
     /** The Store's commit-boundary handler ({@link Backend.onCommitBoundary}), forwarded from the
      *  local engine's `dispatch` brackets so the Store folds every affected view before notifying any
      *  subscriber (cross-view-atomic notification). All this backend's data deltas originate from the
@@ -109,18 +126,115 @@ export class OptimisticBackend {
     boundaryHandler = () => { };
     devObservers = new Set();
     pendingMutations = [];
-    nextMid = 1;
+    /** The next mid to deal, PER DOMAIN (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1): a client
+     *  writing through room + daemon concurrently must not alias one lmid counter. Seeded with the
+     *  `"daemon"` stream at 1; a domain absent from the map starts at 1. In the single-domain
+     *  configuration only `"daemon"` is ever touched, so the sequence is byte-for-byte as before. */
+    nextMid = new Map([["daemon", 1]]);
+    /** The client-global deal counter behind {@link PendingMutation.seq}: one sequence across ALL
+     *  domains, bumped whenever any domain's mid is dealt. The replay order (mids are per-domain and
+     *  incomparable across domains — see the `seq` field doc). */
+    dealSeq = 0;
+    /** The explicit confirming-stream override (§7.1/§3) — see
+     *  {@link OptimisticBackendOptions.domainPolicy}. `undefined` from it ⇒ H-iii derivation. */
+    domainPolicy;
+    /** The final-rejection reason surface ({@link OptimisticBackendOptions.onRejected}). */
+    rejectedHandler;
+    /** Processed `(domain, mid)` outcome frames (H-v) — the deopt handshake's idempotence guard: a
+     *  duplicate frame (the original plus a reconnect re-send's re-answer, or two re-answers across
+     *  two reconnects) must not double-invoke. Needed precisely because a deopt frame can arrive for
+     *  an ALREADY-RETIRED mid (the replay gotcha) — "no matching entry" alone cannot distinguish
+     *  "handle it fresh" from "already handled". Per-domain FIFO, capped like the shell's
+     *  recorded-outcome map ({@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}); past the cap a duplicate of
+     *  an evicted mid would be re-processed — the same bounded-window trade the shell makes, and it
+     *  takes 512 interleaving non-applied outcomes on one domain to open it. */
+    outcomesProcessed = new Map();
+    /** THE room-table registry (302 §2 — one source per table): per connected room `sourceKey`, the
+     *  wire-table → engine-table map for the tables that room OWNS (its writable scope). Written by
+     *  {@link registerRoomTables} (same breath as the engine registration); read by the gate's
+     *  release rename/filter, the mutator staging map, the view swap ({@link processSwapIns}), and
+     *  the client's `__realtimeInspect` bookkeeping. The record outlives a downgrade's disconnect —
+     *  the ghost's views still read the engine tables — and drops at {@link dropGhost} (or the last
+     *  clean release via {@link unregisterRoomTables}). */
+    roomTables = new Map();
+    /** Local view qids currently REGISTERED on a room's namespaced tables (302 §4 swap-in), →
+     *  their sourceKey. Set by {@link processSwapIns}; cleared by the swap-back ({@link dropGhost})
+     *  and view teardown. The original AST stays in {@link asts} throughout — the swap re-registers
+     *  only the ENGINE query. */
+    roomSwappedViews = new Map();
+    /** Room subs whose FIRST snapshot released in the current release — their views swap onto the
+     *  room tables at the release tail ({@link processSwapIns}), strictly AFTER the reconcile folded
+     *  the snapshot into those tables (swapping earlier would hydrate the view EMPTY, a flash). */
+    pendingSwapIns = new Set();
     /** The live fold entries, by fold key `${name}\0${identityJSON}` — at most one per key
      *  (FOLDED-MUTATIONS-DESIGN §8). Insertion order is creation order (the drain/flush tiebreak). */
     folds = new Map();
     /** The fold debounce clock (real timers by default; the oracle injects a virtual one). */
     clock;
-    /** The high-water confirmed mutation id, folded from the lmid system query's
-     *  RELEASED ops (lmid-as-data) — never from a frame. */
-    confirmedLmid = 0;
-    buffer = [];
-    nextSeq = 0;
-    appliedCv = 0;
+    /** The high-water confirmed mutation id, PER DOMAIN (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md
+     *  §7.2 per-domain confirm-drop): an entry with `mid <= watermark[entry.domain]` has been
+     *  confirmed. The `"daemon"` domain is folded from the lmid system query's RELEASED ops
+     *  (lmid-as-data) — never from a frame; a room domain will fold from its own lmid stream (later
+     *  slice). Seeded with `"daemon"` at 0; the daemon scalar `confirmedLmid` (devtools) is
+     *  `watermark.get("daemon")`. */
+    watermark = new Map([["daemon", 0]]);
+    /** The per-source coherence gates (§5.1), by source key. Seeded with the daemon gate at
+     *  construction; a room channel attaches later (`connectSource`). Single-domain: one entry,
+     *  and every gate-generalized path degenerates to the old single-buffer code. NOT the same
+     *  space as {@link watermark}/{@link nextMid}: a DOMAIN can confirm with no gate connected
+     *  (the `__testRelease` seam); a gate's `key` names the domain its lmid stream folds into. */
+    gates = new Map();
+    /** The daemon's gate — the always-present channel (constructor-attached). The devtools
+     *  scalars (`__inspect`) read it directly; its `sync` IS {@link sync} (the agg overlay and
+     *  synthetic tables are daemon-tracked by design). */
+    daemonGate;
+    // --- the §4 lifecycle SYSTEM-STREAM plane (Slice I-iii) --------------------------------
+    /** System retains by source qid ({@link retainSystemQuery}): a subscription with NO store view
+     *  and NO user-visible table — its frames buffer on its gate exactly like {@link LMID_QID}'s and
+     *  fold at RELEASE time ({@link foldSystemFrames}), never entering the sync layer or the local
+     *  engine. The spec names which system table the qid serves and the scope/doc it was minted for
+     *  (the fold's row filter). Empty on every non-lifecycle client — every partition below is then
+     *  a structural no-op and the release path is byte-identical to before. */
+    systemQids = new Map();
+    /** The §4.2 fence state: room doc → highest `flush_seq` delivered through the daemon plane
+     *  (monotone max-fold; a remove never regresses it). Slice I-v's ghost-drop consumer — I-iii
+     *  only maintains + exposes it (`__inspectDomains().lifecycle`). */
+    roomWatermarks = new Map();
+    /** The §4.1 occupancy state: scope → (client_id → expires_at) from the doorbell stream. Slice
+     *  I-iv's doorbell consumer (the 1→2 re-lease reaction) — I-iii only maintains + exposes it.
+     *  A snapshot REPLACES the scope's map (authoritative re-hydrate); a batch folds add/edit/remove
+     *  incrementally (the age-out sweep's deletes arrive as removes). */
+    scopeSessions = new Map();
+    /** The I-iv doorbell event sink ({@link onScopeSessions}) — fired once per scope a release's
+     *  scope-session fold touched, AFTER the whole release applied. Default no-op: a client that
+     *  never registers (no lifecycle plane) pays nothing. */
+    scopeSessionsHandler = () => { };
+    /** Deferred old-channel row GC for in-flight upgrade retargets ({@link retargetRemoteQuery}):
+     *  sub sourceQid → the channel it left. The rows the OLD gate's sync holds for the qid stay
+     *  visible (merge: daemon tier) until the sub's first snapshot RELEASES on its new room channel
+     *  ({@link flushRetargetGc}) — dropping them at retarget time would emit net removes ahead of
+     *  the room's re-adds, the flicker the two-phase cutover exists to avoid. Doubles as the
+     *  wrong-channel GRACE window in {@link onFrame}: a frame already in flight from the old
+     *  channel when the sub moved is stale, not a wiring bug. Empty on every non-upgrade client —
+     *  every consultation below is then a structural no-op. */
+    pendingRetargetGc = new Map();
+    /** The §4.2 GHOSTS (Slice I-v): demoted room sources awaiting their watermark fence, by
+     *  sourceKey. Written only by {@link demoteRoomSource}; evaluated after every release
+     *  ({@link evaluateGhosts}) and dropped by {@link dropGhost} once the fence clears with no
+     *  sent room-domain pending left. Empty on every non-downgrade client — the per-release
+     *  evaluation is then a structural no-op. */
+    ghosts = new Map();
+    /** The I-v stuck-downgrade surface ({@link onDowngradeStuck}) — fired AT MOST ONCE per ghost
+     *  when its fence is satisfied but sent room-domain mids remain unresolved (§7.5: they retire
+     *  only through outcome resolution; the ghost holds rather than inventing a timeout-retire).
+     *  Default no-op. */
+    downgradeStuckHandler = () => { };
+    /** The 302 §6.1 context-coverage surface ({@link onRoomContextJoin}) — fired at most once per
+     *  view ({@link contextJoinWarned}), at swap-in, when its AST references tables the room does
+     *  not own. Default no-op. */
+    roomContextJoinHandler = () => { };
+    /** Views the context-coverage event already fired for (once per view; cleared on teardown). */
+    contextJoinWarned = new Set();
     asts = new Map();
     /** Per query: the base tables its result can draw from (from the AST tree). */
     queryTables = new Map();
@@ -145,16 +259,21 @@ export class OptimisticBackend {
         this.local = new WasmBackend(schema);
         this.local.onEvent((qid, ev) => {
             // Stamp a newly-hydrating query's reconcile batch as a catch-up (initial-hydration) delivery,
-            // so the Store phases it as a `snapshot` rather than narrating the whole first result set.
-            const stamped = ev.type === "batch" && this.catchUpQids?.has(qid) ? { ...ev, catchUp: true } : ev;
-            this.handler(qid, stamped);
+            // so the Store phases it as a `snapshot` rather than narrating the whole first result set. Record
+            // that we emitted a hydration batch for this qid, so `onProgress` knows which newly-hydrated qids
+            // still need an explicit empty catch-up (they folded nothing — see {@link catchUpEmitted}).
+            const stamp = ev.type === "batch" && this.catchUpQids?.has(qid) === true;
+            if (stamp)
+                this.catchUpEmitted?.add(qid);
+            this.handler(qid, stamp ? { ...ev, catchUp: true } : ev);
         });
         // Forward the local engine's commit brackets up to the Store (cross-view-atomic notification):
         // every data delta this backend emits comes from `this.local`, so its commit boundaries are ours.
         this.local.onCommitBoundary((phase) => this.boundaryHandler(phase));
         this.colCounts = colCountsFromSchema(schema);
         this.colIndex = colIndexFromSchema(schema);
-        this.sync = new NormalizedSync(pkColsFromSchema(schema), this.colCounts);
+        this.pkCols = pkColsFromSchema(schema);
+        this.sync = new NormalizedSync(this.pkCols, this.colCounts);
         this.specs = tableSpecsFromSchema(schema);
         this.localTables = localTableNames(schema);
         this.source = source;
@@ -163,21 +282,119 @@ export class OptimisticBackend {
         this.user = opts.user ?? (() => "");
         this.bufferCap = opts.bufferCap ?? 1024;
         this.clock = opts.clock ?? REAL_CLOCK;
-        // Validate each server hello against our OWN typed schema → reject a schema skew
-        // (CRIT#4). The reserved lmid table is part of the expected set so the system
-        // query's hello passes. Synthetic agg tables join the set as queries register them.
-        this.clientTablesBase = [...normalizedTableSchemas(schema), CLIENT_MUTATIONS_SCHEMA];
-        this.source.expectClientSchema?.(this.clientTablesBase);
-        this.source.onNormalized((qid, ev) => this.onNormalized(qid, ev));
-        this.source.onProgress((frame) => this.onProgress(frame));
-        this.source.onRestart?.(() => this.resetForRestart());
-        // The lmid system query (lmid-as-data): our confirmations arrive on this stream,
-        // cv-tagged, released by the same cvMin as the data they belong to. The server
-        // derives the identity from the connection; args are advisory.
-        this.source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
+        // No policy configured ⇒ every route DERIVES (H-iii §3). With no room gate connected the
+        // derivation short-circuits to "daemon", so a single-domain app is byte-for-byte as before.
+        this.domainPolicy = opts.domainPolicy ?? (() => undefined);
+        this.rejectedHandler = opts.onRejected ?? (() => { });
+        // The reserved lmid table + (I-iii) the four lifecycle system tables join the expected set so
+        // a system subscription's hello passes CRIT#4 validation. Extra CLIENT-side entries are inert
+        // for every other server hello (validation only checks tables a server advertises), so a
+        // client that never receives a lifecycle block is byte-identical.
+        this.clientTablesBase = [...normalizedTableSchemas(schema), CLIENT_MUTATIONS_SCHEMA, ...LIFECYCLE_TABLE_SCHEMAS];
+        // The daemon is the always-present channel: its gate is attached at construction, and its
+        // per-source refcount space IS `this.sync` (the agg overlay reads it directly). A room
+        // channel attaches through the same seam later (§5.1; Slice G).
+        this.daemonGate = this.attachGate("daemon", source, this.sync);
+    }
+    /** Wire one authority channel into its own coherence gate (§5.1): every frame the channel
+     *  delivers buffers on THIS gate's cv timeline, its progress frames release THIS buffer, its
+     *  restart resets THIS gate alone, and its reserved lmid stream folds into `watermark[key]`.
+     *  Validates each server hello against our OWN typed schema → reject a schema skew (CRIT#4);
+     *  the reserved lmid table is part of the expected set so the system query's hello passes, and
+     *  synthetic agg tables join the set as queries register them. */
+    attachGate(key, source, sync) {
+        const gate = { key, source, sync, buffer: [], nextSeq: 0, appliedCv: 0 };
+        this.gates.set(key, gate);
+        source.expectClientSchema?.([...this.clientTablesBase, ...this.synthetic.values()]);
+        source.onNormalized((qid, ev) => this.onFrame(gate, qid, ev));
+        source.onProgress((frame) => this.onGateProgress(gate, frame));
+        source.onRestart?.(() => this.resetGate(gate));
+        // The deopt handshake's client half (H-v §3.3): the channel's `mutationOutcome` frames arrive
+        // as `(domain = gate.key, frame)`. OUT-OF-BAND — the source dispatches on arrival and this
+        // handler runs immediately, NEVER behind the gate's cv buffer: a deopt must migrate its entry
+        // BEFORE the buffered lmid release that would otherwise retire it as a success (and the §7.3
+        // hold-back trigger, keyed on `p.domain`, would park its staged writes the wrong way).
+        source.onMutationOutcome?.((frame) => this.handleMutationOutcome(gate.key, frame));
+        // §7.5 rule 3 (H-v): a re-established session re-sends this DOMAIN's unconfirmed pending
+        // envelopes with their ORIGINAL mids — the authority's own ledger dedups (an applied mid is
+        // silent; a non-applied one is re-answered from the recorded-outcome map into the handler
+        // above). This is the deopt crash-window closer: a frame lost with its socket is re-earned.
+        source.onResync?.(() => this.resendPending(gate.key));
+        // The lmid system query (lmid-as-data): confirmations arrive on this channel's stream,
+        // cv-tagged, released by the same cvMin as the data they belong to. The server derives
+        // the identity from the connection; args are advisory. Qid 0 is reserved PER CHANNEL —
+        // it never collides with Store-dealt qids and never enters the sync layer.
+        source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
+        return gate;
+    }
+    /** Attach a SECOND authority channel (§5.1) — the seam Slice G's room upgrade calls with the
+     *  ws-backed room feed. Rooms speak the daemon protocol verbatim (§2.4: the client cannot tell
+     *  a room from the daemon), so the argument is a full {@link OptimisticSource} — exactly what
+     *  `@rindle/remote` builds from `{roomUrl, leaseToken}`. The channel buffers/releases on its
+     *  own cv timeline (an independent §5.1 gate: coherent within, eventual across) and its
+     *  reserved lmid stream folds into `watermark[sourceKey]` — so `sourceKey` must equal the
+     *  `domainPolicy` name for the mutations this authority confirms. The converse is NOT required:
+     *  a domain may exist with no connected gate (`__testRelease` drives confirms gate-less); the
+     *  live production path stays daemon-only until G calls this. */
+    connectSource(sourceKey, source) {
+        if (this.gates.has(sourceKey)) {
+            throw new Error(`optimistic backend: source ${sourceKey} is already connected`);
+        }
+        const gate = this.attachGate(sourceKey, source, new NormalizedSync(this.pkCols, this.colCounts));
+        // A re-upgrade of a doc whose tables are still registered (a ghost that never dropped, or a
+        // quick down/up bounce) adopts the surviving record as this incarnation's rename map.
+        const tables = this.roomTables.get(sourceKey);
+        if (tables !== undefined)
+            gate.tableMap = tables;
+        // …and CANCELS the pending swap-back: the room is the authority again, its views stay swapped,
+        // and a ghost left armed would fire against this LIVE gate when the old fence clears —
+        // un-swapping the views and unregistering the namespaced tables the gate's tableMap still
+        // renames deltas into (the next release would then throw from serverBatchBegin and poison the
+        // rebase state). A future downgrade arms a fresh ghost with its own fence.
+        this.ghosts.delete(sourceKey);
+    }
+    /** Register the tables room `sourceKey` OWNS (its writable scope — 302 §2): each wire table
+     *  gets its own namespaced ENGINE table (`{@link roomEngineTable}`), an ordinary tracked table
+     *  whose sole authority is the room channel. From here on the channel's released deltas rename
+     *  into these tables (wire tables outside the map are DROPPED — context stays daemon-owned,
+     *  302 §6), room-domain mutators stage onto them, and a room-homed view swaps onto them once
+     *  the room sub hydrates ({@link processSwapIns}). Idempotent per (sourceKey, table); a wire
+     *  table unknown to the schema is skipped (nothing to hold rows for). */
+    registerRoomTables(sourceKey, tables) {
+        if (sourceKey === "daemon") {
+            throw new Error("optimistic backend: the daemon is not a room — no namespaced tables");
+        }
+        let map = this.roomTables.get(sourceKey);
+        if (!map)
+            this.roomTables.set(sourceKey, (map = new Map()));
+        for (const table of tables) {
+            if (map.has(table))
+                continue;
+            const spec = this.specs[table];
+            if (spec === undefined || this.localTables.has(table))
+                continue;
+            const engineTable = roomEngineTable(table, sourceKey);
+            this.local.registerTable(engineTable, { columns: spec.columns, primaryKey: spec.primaryKey });
+            map.set(table, engineTable);
+        }
+        const gate = this.gates.get(sourceKey);
+        if (gate !== undefined)
+            gate.tableMap = map;
+    }
+    /** The wire-table → engine-table map for room `sourceKey`'s owned tables (empty when none) —
+     *  the client's idempotence check and `__realtimeInspect` read THIS record (one source of
+     *  truth; the client keeps no shadow copy). */
+    roomTablesFor(sourceKey) {
+        return this.roomTables.get(sourceKey) ?? EMPTY_ROOM_TABLES;
     }
     // --- the Backend seam ---------------------------------------------------------
-    registerQuery(qid, ast, remote) {
+    /** `channel` (G-iii registration-time routing) names the authority channel the remote sub
+     *  registers on — a `connectSource`d gate key; default `"daemon"` (every existing caller is
+     *  byte-identical). Slice G-v threads the lease's `realtime.sourceKey` here. Validated FIRST
+     *  (like the E3 check below): a bad channel must throw before any per-query state is recorded. */
+    registerQuery(qid, ast, remote, channel) {
+        if (remote)
+            this.requireGate(channel ?? "daemon");
         // queryTables is derived from the ORIGINAL ast — its `count(comments)` subquery names
         // `comment`, so an optimistic comment mutation flips this query to `unknown` (§6). The
         // local engine, by contrast, runs the REWRITTEN ast (reads the synthetic `__agg_*`).
@@ -206,11 +423,11 @@ export class OptimisticBackend {
         // child is left a native reduce (L1) — `rewriteAggregates`/`ensureSyntheticTables` skip it.
         this.ensureSyntheticTables(qid, ast);
         // Local first (synchronous empty view), then the server stream hydrates it.
-        this.local.registerQuery(qid, rewriteAggregates(ast, (t) => this.localTables.has(t)));
+        this.local.registerQuery(qid, this.plainEngineAst(ast));
         if (remote) {
             // A remote query is `unknown` until its first server snapshot lands (hydration); retainRemote
             // attaches it to the sub and sets the lifecycle against the sub's hydration state.
-            this.retainRemote(qid, remote);
+            this.retainRemote(qid, remote, qid, channel);
         }
         else {
             // No server stream (a purely local AST view — or the local half of a split retain whose
@@ -280,11 +497,22 @@ export class OptimisticBackend {
             this.source.expectClientSchema?.([...this.clientTablesBase, ...this.synthetic.values()]);
     }
     unregisterQuery(qid) {
+        this.roomSwappedViews.delete(qid); // a swapped view's teardown forgets its room backing
+        this.contextJoinWarned.delete(qid); // …and its once-per-view coverage-warn latch
         const remoteQid = this.releaseRemote(qid);
-        if (remoteQid !== undefined)
-            this.buffer = this.buffer.filter((f) => f.qid !== remoteQid);
-        // GC: rows this remote footprint SOLELY referenced fall to refcount 0 → net removes.
-        const gc = remoteQid === undefined ? [] : this.sync.dropQuery(remoteQid);
+        // GC: rows this remote footprint SOLELY referenced fall to refcount 0 → net removes. A qid
+        // lives on ONE channel, so at most one gate's dropQuery is non-empty (dropQuery of an
+        // unknown qid returns []) — but sweep every gate so this needs no ownership lookup.
+        const gcs = [];
+        if (remoteQid !== undefined) {
+            this.pendingRetargetGc.delete(remoteQid); // the sweep below covers a mid-retarget teardown
+            for (const gate of this.gates.values()) {
+                gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
+                const gc = mapGateDeltas(gate, gate.sync.dropQuery(remoteQid));
+                if (gc.length)
+                    gcs.push([gate.key, gc]);
+            }
+        }
         // Tear down the local pipeline+view first so the reconcile cycle below skips it.
         this.local.unregisterQuery(qid);
         // The GC removals must leave BOTH head AND the engine's `sync` baseline. A plain
@@ -292,9 +520,10 @@ export class OptimisticBackend {
         // optimistic REMOVE: the next release's rewind diffs head against sync+D and RESURRECTS
         // them, GC never frees anything, and a later query is served the stale/deleted row
         // forever (CRIT#2). Deliver them as a coherent SERVER delta instead — the same
-        // sync-moving boundary `onProgress` uses — so head and sync both drop the rows.
-        if (gc.length)
-            this.runReconcileCycle(gc);
+        // sync-moving boundary the release gate uses — so head and sync both drop the rows,
+        // against the SOURCE whose baseline held them.
+        for (const [key, gc] of gcs)
+            this.runReconcileCycle(key, gc);
         // The local pipeline is gone (no live conn) and the remote footprint's `__agg` rows were
         // GC'd above, so any synthetic table this was the last reader of can now be freed (§4).
         this.releaseSyntheticTables(qid);
@@ -305,10 +534,15 @@ export class OptimisticBackend {
         this.pendingState.delete(qid); // §7.2 cache, keyed by the local materialized qid (a monotonic
         // Store counter — re-materialize gets a fresh id, never this one again), so drop it on teardown.
     }
-    retainRemoteQuery(qid, remote, localQueryId, ast) {
+    /** `channel` as in {@link registerQuery} (G-iii): the gate the remote sub registers on; default
+     *  `"daemon"`. This is the split-retain seam G-v's resolve-then-register drives — resolve the
+     *  lease, learn `realtime.sourceKey`, `connectSource` it, then retain the query on that channel.
+     *  Validated FIRST so a bad channel throws before any synthetic-table refcount moves. */
+    retainRemoteQuery(qid, remote, localQueryId, ast, channel) {
+        this.requireGate(channel ?? "daemon");
         if (ast)
             this.ensureSyntheticTables(qid, ast);
-        this.retainRemote(qid, remote, localQueryId);
+        this.retainRemote(qid, remote, localQueryId, channel);
     }
     releaseRemoteQuery(qid) {
         const remoteQid = this.releaseRemote(qid);
@@ -319,10 +553,309 @@ export class OptimisticBackend {
         }
         if (remoteQid === undefined)
             return;
-        this.buffer = this.buffer.filter((f) => f.qid !== remoteQid);
-        const gc = this.sync.dropQuery(remoteQid);
-        if (gc.length)
-            this.runReconcileCycle(gc);
+        // A mid-retarget release: the every-gate sweep below IS the deferred old-channel GC
+        // (dropQuery hits the old gate's sync too), so retire the pending record — and its
+        // wrong-channel grace — with it.
+        this.pendingRetargetGc.delete(remoteQid);
+        // Per-gate sweep, like `unregisterQuery`: at most one gate owned this qid's frames/rows.
+        for (const gate of this.gates.values()) {
+            gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
+            const gc = mapGateDeltas(gate, gate.sync.dropQuery(remoteQid));
+            if (gc.length)
+                this.runReconcileCycle(gate.key, gc);
+        }
+    }
+    /** The Slice I-iv upgrade retarget (§4.1 "Retarget" / the doorbell reaction): move a LIVE
+     *  (name, args) sub — every retain of it and every local view it feeds, wholesale — from the
+     *  channel it lives on onto `sourceKey`'s (already-`connectSource`d, already-promoted) room
+     *  channel, WITHOUT the view ever dropping its rows. Returns the sub's wire `sourceQid` (the
+     *  identity the client's renewal loop re-subscribes with).
+     *
+     *  Why a dedicated primitive: the one-channel-per-(name,args) invariant ({@link retainRemote}'s
+     *  loud throw) is correct — a sub's frames must never split across two cv timelines — so the
+     *  upgrade cannot simply retain a second sub on the room and release the daemon one; and the
+     *  naive release-then-retain order GCs the daemon sync's rows synchronously (net removes emit,
+     *  the view flashes empty) a full ws round trip before the room's seq-0 snapshot refills it.
+     *  The cutover is therefore TWO-PHASE around the room's first release:
+     *
+     *   1. NOW (here): unsubscribe the old channel's wire sub, sweep its still-buffered frames for
+     *      this qid (their cv timeline continues without the sub — the hello-supersession
+     *      precedent), flip `sub.channel`, re-arm `sub.hydrated` (the room's own snapshot is the
+     *      cutover point), and register on the room source (its resolver presents the handed
+     *      roomToken). The old gate's SYNC rows are deliberately NOT dropped: they keep the view's
+     *      plain tables populated through the window — the view still reads them until the swap.
+     *   2. AT THE ROOM'S FIRST RELEASED SNAPSHOT: the reconcile folds the snapshot into the room's
+     *      namespaced tables, the release tail SWAPS every local view onto them (302 §4.1,
+     *      {@link processSwapIns} — the accepted-flash boundary), and {@link flushRetargetGc}'s
+     *      deferred `dropQuery`+reconcile on the OLD gate then GCs the plain-table rows the sub
+     *      alone referenced — invisible to the swapped views.
+     *
+     *  Idempotent per target channel: a sub already on `sourceKey` returns immediately (the
+     *  double-doorbell / re-entrancy guard — one retarget per (query, sourceKey)). Validates before
+     *  mutating: a throw here leaves the sub fully daemon-attached (the client's fail-open). */
+    retargetRemoteQuery(remote, sourceKey) {
+        const newGate = this.requireGate(sourceKey); // throw loudly BEFORE any sub state moves
+        const key = remoteKey(remote);
+        const sub = this.remoteSubs.get(key);
+        if (!sub) {
+            throw new Error(`optimistic backend: no live sub for query "${remote.name}" — nothing to retarget`);
+        }
+        if (sub.channel === sourceKey)
+            return sub.sourceQid; // already there — idempotent
+        const oldGate = this.gates.get(sub.channel) ?? this.daemonGate;
+        oldGate.source.unregisterQuery(sub.sourceQid);
+        oldGate.buffer = oldGate.buffer.filter((f) => f.qid !== sub.sourceQid);
+        this.pendingRetargetGc.set(sub.sourceQid, sub.channel);
+        sub.channel = sourceKey;
+        sub.hydrated = false;
+        newGate.source.registerQuery(sub.sourceQid, remote);
+        return sub.sourceQid;
+    }
+    /** Phase 2 of {@link retargetRemoteQuery}, run at the end of every gate release: once a
+     *  retargeted sub's first snapshot has RELEASED on its new channel (`sub.hydrated` re-armed at
+     *  retarget, re-set by {@link markSubHydrated} inside this very release), drop the qid's rows
+     *  from the OLD gate's sync and reconcile them out — after the room's rows are already applied,
+     *  so the winner flip is value-equal (net-zero; see the phase table above). A sub torn down
+     *  mid-window was already swept by `releaseRemoteQuery`/`unregisterQuery` (which delete the
+     *  record); a vanished record here is pruned defensively. */
+    flushRetargetGc(gate) {
+        if (this.pendingRetargetGc.size === 0)
+            return; // every non-upgrade release: structural no-op
+        for (const [sourceQid, oldGateKey] of this.pendingRetargetGc) {
+            const key = this.sourceToRemote.get(sourceQid);
+            const sub = key !== undefined ? this.remoteSubs.get(key) : undefined;
+            if (!sub) {
+                this.pendingRetargetGc.delete(sourceQid);
+                continue;
+            }
+            if (sub.channel !== gate.key || !sub.hydrated)
+                continue; // not this gate / not yet cut over
+            this.pendingRetargetGc.delete(sourceQid);
+            const oldGate = this.gates.get(oldGateKey);
+            if (!oldGate)
+                continue;
+            const gc = mapGateDeltas(oldGate, oldGate.sync.dropQuery(sourceQid));
+            if (gc.length)
+                this.runReconcileCycle(oldGateKey, gc);
+        }
+    }
+    // --- the §4.2 downgrade: demote → ghost → fence → drop (Slice I-v) ----------------------
+    /** The I-v downgrade orchestration primitive (§4.2/§7.4, re-expressed by 302 §4.2 as the
+     *  SWAP-BACK GATE): retire room `sourceKey` behind the watermark fence. The caller has ALREADY
+     *  retargeted every live sub off the channel ({@link retargetRemoteQuery} room→daemon —
+     *  validated loudly below) and holds the fence from the api-server's downgrade response
+     *  (`finalFlushSeq` = the room's last COMMITTED flush seq; `doc` keys the §4.2 watermark fold,
+     *  {@link roomWatermarks}). Steps, in order:
+     *
+     *   1. **Disconnect** the channel ({@link disconnectSource}): handlers detached, gate + buffer
+     *      dropped. `nextMid`/`watermark`/processed-outcomes for the domain are KEPT FOREVER (§7.1:
+     *      an assigned mid pins its domain; a later re-upgrade of the same doc continues the
+     *      sequence — {@link connectSource} attaches a fresh gate and the lmid snapshot max-folds
+     *      into the surviving watermark). Disconnecting BEFORE the daemon sub's first release is
+     *      load-bearing: it makes {@link flushRetargetGc}'s deferred old-channel GC a no-op (gate
+     *      gone ⇒ record deleted, nothing dropped). The room's namespaced tables — and the views
+     *      swapped onto them — deliberately stay: frozen at the room's last state, they keep the
+     *      document visible while the falling-back follower may still lack the final flush.
+     *      Swapping back earlier would show its pre-flush images — the regression §4.2 prevents.
+     *   2. **Ghost + first evaluation**: the record joins {@link ghosts} and is evaluated once
+     *      immediately — `finalFlushSeq === 0` (a never-flushed room) with no room-domain pending
+     *      drops on the spot, the single-daemon first-frame case.
+     *
+     *  In-flight discipline (§7.5): entries with `mid !== null` on `sourceKey` stay PINNED (rule
+     *  2 — never re-route a sent mutation); their resolution arrives via the daemon-carried
+     *  ledger+outcome folds (I-iii) and blocks the drop until then. Idempotent per sourceKey (a
+     *  second labeled query sharing the room demotes into the existing ghost). */
+    demoteRoomSource(sourceKey, doc, finalFlushSeq) {
+        if (sourceKey === "daemon") {
+            throw new Error("optimistic backend: the daemon source cannot be demoted");
+        }
+        // Validate FIRST (nothing mutated yet): a live sub still on the channel would silently
+        // starve once the gate detaches — the caller must retarget every sub off the room first.
+        for (const sub of this.remoteSubs.values()) {
+            if (sub.channel === sourceKey) {
+                throw new Error(`optimistic backend: cannot demote ${JSON.stringify(sourceKey)} — query "${sub.remote.name}" is still retained on it (retarget it to the daemon first)`);
+            }
+        }
+        // Idempotent per sourceKey (co-tenant queries sharing the room demote into the existing
+        // ghost) — but NEVER a bare early-return: each demote carries its own fence, so keep the
+        // NEWEST flush (monotone max — swapping back on an older fence would show pre-flush images),
+        // and disconnect defensively in case a gate re-attached since the ghost was armed (a
+        // down→up→down bounce; {@link connectSource} cancels the ghost on re-upgrade, so this arm
+        // normally finds no gate — but a stale gate left connected would let the next daemon release
+        // GC the room slice out from under the still-swapped views, the §4.2 regression).
+        const existing = this.ghosts.get(sourceKey);
+        if (existing) {
+            this.disconnectSource(sourceKey);
+            existing.finalFlushSeq = Math.max(existing.finalFlushSeq, finalFlushSeq);
+            this.evaluateGhosts();
+            return;
+        }
+        this.disconnectSource(sourceKey); // (1) the channel
+        this.ghosts.set(sourceKey, { doc, finalFlushSeq, stuckReported: false }); // (2)
+        this.evaluateGhosts();
+    }
+    /** Detach one connected room channel (Slice I-v step 3): the source's handlers are replaced
+     *  with no-ops (the {@link OptimisticSource} handler seam is single-registration, so this IS
+     *  the detach — a late frame from a dying socket can no longer touch any bookkeeping), its
+     *  reserved lmid sub is unregistered, and the gate — buffer, per-source sync, cv watermark —
+     *  is dropped from {@link gates}. The DOMAIN state deliberately survives forever:
+     *  `nextMid[sourceKey]`, `watermark[sourceKey]`, and the processed-outcome set are untouched
+     *  (§7.1 — an assigned mid pins its domain; a re-upgrade must continue, never restart, the mid
+     *  sequence; {@link connectSource} then attaches a fresh gate whose lmid snapshot max-folds
+     *  into the surviving watermark via {@link foldConfirm}). Closing the underlying transport is
+     *  the caller's job. Idempotent (a missing gate is a no-op). */
+    disconnectSource(sourceKey) {
+        if (sourceKey === "daemon") {
+            throw new Error("optimistic backend: the daemon source cannot be disconnected");
+        }
+        const gate = this.gates.get(sourceKey);
+        if (!gate)
+            return;
+        this.gates.delete(sourceKey);
+        gate.source.onNormalized(() => { });
+        gate.source.onProgress(() => { });
+        gate.source.onRestart?.(() => { });
+        gate.source.onMutationOutcome?.(() => { });
+        gate.source.onResync?.(() => { });
+        gate.source.unregisterQuery(LMID_QID);
+    }
+    /** Register the I-v stuck-downgrade sink — see {@link DowngradeStuckEvent}. One handler (a
+     *  later registration replaces it, the {@link onScopeSessions} convention); client.ts maps it
+     *  onto the loud anomaly surface. */
+    onDowngradeStuck(handler) {
+        this.downgradeStuckHandler = handler;
+    }
+    /** Register the 302 §6.1 context-coverage sink — see {@link RoomContextJoinEvent}. One handler
+     *  (a later registration replaces it, the {@link onScopeSessions} convention); client.ts maps
+     *  it onto the loud anomaly surface. */
+    onRoomContextJoin(handler) {
+        this.roomContextJoinHandler = handler;
+    }
+    /** The I-v ghost-drop watcher (§4.2), run after every applied release ({@link applyRelease} —
+     *  the seam where {@link roomWatermarks} has just folded and the confirm-drop has just run) and
+     *  once at demote time. For each ghost: the fence must be satisfied
+     *  (`roomWatermarks[doc] ≥ finalFlushSeq`; 0 is trivially satisfied) AND no SENT room-domain
+     *  pending may remain (§7.5 — such entries resolve only through the daemon-carried
+     *  outcome/ledger folds; an entry that never reached the room is undecidable, so the ghost
+     *  HOLDS and the stuck event fires exactly once, naming the mids). Both satisfied ⇒
+     *  {@link dropGhost}. */
+    evaluateGhosts() {
+        if (this.ghosts.size === 0)
+            return; // every non-downgrade release: structural no-op
+        for (const [sourceKey, ghost] of [...this.ghosts]) {
+            // A LIVE gate means the doc re-upgraded — dropping now would dismantle the live room
+            // (un-swap its views, unregister the tables its tableMap renames into). connectSource
+            // cancels the ghost on re-upgrade, so this guard is purely defensive; hold, never drop.
+            if (this.gates.has(sourceKey))
+                continue;
+            if ((this.roomWatermarks.get(ghost.doc) ?? 0) < ghost.finalFlushSeq)
+                continue; // fence holds
+            const stuck = this.pendingMutations.filter((p) => p.domain === sourceKey && p.mid !== null);
+            if (stuck.length > 0) {
+                if (!ghost.stuckReported) {
+                    ghost.stuckReported = true;
+                    this.downgradeStuckHandler({ sourceKey, doc: ghost.doc, mids: stuck.map((p) => p.mid) });
+                }
+                continue; // hold — never a timeout-retire (§7.5 rule 2)
+            }
+            this.dropGhost(sourceKey);
+        }
+    }
+    /** Drop one cleared ghost — the 302 §4.2 SWAP-BACK: under the fence the daemon tables are
+     *  value-equal-or-ahead of the room's final state, so (1) every view swapped onto the room's
+     *  namespaced tables re-registers on its ORIGINAL (daemon-table) AST — visually a no-op, the
+     *  Store folds the re-hello as an in-place reset; (2) the namespaced tables unregister (no
+     *  reader is left after the swap); (3) ONE daemon reconcile re-invokes the pending set so any
+     *  entry whose writes had staged onto the now-gone room tables re-stages onto the daemon tables
+     *  (its domain policy stopped naming the dead room when the client dropped it). The whole drop
+     *  runs under one commit boundary so the swap and the re-staged predictions notify as ONE step.
+     *  After this, a FUTURE upgrade of the same doc registers again from scratch. */
+    dropGhost(sourceKey) {
+        this.ghosts.delete(sourceKey);
+        this.inOneCommit(() => {
+            for (const [qid, key] of [...this.roomSwappedViews]) {
+                if (key !== sourceKey)
+                    continue;
+                this.roomSwappedViews.delete(qid);
+                const ast = this.asts.get(qid);
+                if (ast === undefined)
+                    continue;
+                this.local.unregisterQuery(qid);
+                this.local.registerQuery(qid, this.plainEngineAst(ast));
+            }
+            this.unregisterRoomTables(sourceKey);
+            // One daemon reconcile re-stages the pending set onto the surviving tables. Run whenever
+            // any pending exists: unregistering the room tables took their staged copies with the tree.
+            if (this.pendingMutations.length > 0)
+                this.runReconcileCycle("daemon", []);
+        });
+        this.refreshPending(); // the reconcile may have dropped a throwing re-invocation
+    }
+    /** Unregister room `sourceKey`'s namespaced engine tables and drop the {@link roomTables}
+     *  record. Callers must have no view registered on them (the engine refuses otherwise —
+     *  loud by design). No-op for an unknown sourceKey. */
+    unregisterRoomTables(sourceKey) {
+        const map = this.roomTables.get(sourceKey);
+        if (!map)
+            return;
+        this.roomTables.delete(sourceKey);
+        for (const engineTable of map.values())
+            this.local.unregisterTable(engineTable);
+    }
+    // --- the §4 lifecycle SYSTEM-STREAM retains (Slice I-iii) ------------------------------
+    /** Retain one minted SYSTEM subscription (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §4, Slice
+     *  I-iii): a wire sub with NO store view and NO user-visible table. Registered through the same
+     *  {@link RemoteSub} bookkeeping as any remote retain — so qid→channel ownership, the overflow
+     *  re-subscribe, and refcounted release all work unchanged — but with an EMPTY `localQids` set
+     *  (no hydration/resultType coupling) and a {@link systemQids} record telling the release path
+     *  which system table this qid's frames carry (`spec.table`) and which scope/doc it was minted
+     *  for (the fold's row filter). Its frames then buffer on the channel's gate exactly like
+     *  {@link LMID_QID}'s and fold at RELEASE time in {@link foldSystemFrames} — riding the SAME
+     *  buffered cv path as the data they co-committed with (fence coherence: an out-of-band
+     *  shortcut would break I-ii's co-commit ordering guarantee).
+     *
+     *  `channel` defaults to `"daemon"` — the system tables live in the DAEMON store (that is the
+     *  point: outcome/ledger/watermark rows must be readable with no room socket alive, §7.1
+     *  "load-bearing for §7.5"). Idempotence per (table, scope/doc) is the CALLER's job (client.ts
+     *  keys its retains on exactly that); a duplicate retain of the SAME remote identity refcounts
+     *  like any sub. */
+    retainSystemQuery(retainQid, remote, spec, channel = "daemon") {
+        const gate = this.requireGate(channel); // throw loudly BEFORE any sub state moves
+        const key = remoteKey(remote);
+        let sub = this.remoteSubs.get(key);
+        if (sub) {
+            if (sub.channel !== channel) {
+                throw new Error(`optimistic backend: system query "${remote.name}" is already retained on channel ${JSON.stringify(sub.channel)} — cannot retain it on ${JSON.stringify(channel)}`);
+            }
+            sub.refCount++;
+            this.localToRemote.set(retainQid, key);
+            this.remoteRetainToLocal.set(retainQid, undefined);
+            return;
+        }
+        // A fresh sub: deliberately NOT `retainRemote` — its `localQueryId` default would couple this
+        // retain's qid to the view-hydration machinery (`hydrated`/`resultType`), and a system stream
+        // has no view to hydrate.
+        sub = { sourceQid: retainQid, remote, refCount: 1, localQids: new Map(), hydrated: false, channel };
+        this.remoteSubs.set(key, sub);
+        this.sourceToRemote.set(retainQid, key);
+        this.localToRemote.set(retainQid, key);
+        this.remoteRetainToLocal.set(retainQid, undefined);
+        this.systemQids.set(retainQid, { ...spec });
+        gate.source.registerQuery(retainQid, remote);
+    }
+    /** Release a {@link retainSystemQuery} retain. Refcounted like any sub; the LAST release
+     *  unregisters from the owning channel, sweeps its buffered frames, and drops the
+     *  {@link systemQids} record. The folded lifecycle STATE (`roomWatermarks`/`scopeSessions`/
+     *  processed outcomes) deliberately survives — the fence is monotone truth about the store, not
+     *  about the subscription (a re-retained fence must not forget a cleared watermark). */
+    releaseSystemQuery(retainQid) {
+        const remoteQid = this.releaseRemote(retainQid);
+        if (remoteQid === undefined)
+            return; // still refcounted (or unknown)
+        for (const gate of this.gates.values()) {
+            gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
+        }
+        this.systemQids.delete(remoteQid);
     }
     /** Raw CRUD has no optimistic story (§9 replaces it with named mutators). Register a
      *  mutator — even a trivial one — and `invoke` it. */
@@ -402,32 +935,119 @@ export class OptimisticBackend {
             mutator(tx, args);
         }
     }
+    /** Deal the next wire mid from `domain`'s ledger (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md
+     *  §7.1) and advance that counter. A domain absent from the map starts at 1. Per-domain, so a
+     *  client writing through room + daemon concurrently keeps two gapless, non-aliasing sequences.
+     *  The client-global `seq` is stamped in the same breath — the ONE cross-domain total order
+     *  (confirmation order is per-domain; replay order is client-global). Bundled here so no call
+     *  site can deal a mid without its seq. ONE caller discards the seq deliberately: the H-v deopt
+     *  flip ({@link handleMutationOutcome}) keeps the entry's ORIGINAL seq — its replay position —
+     *  and takes only the fresh mid (the dealSeq bump is harmless: seq consumers order, never
+     *  count). */
+    dealMid(domain) {
+        const mid = this.nextMid.get(domain) ?? 1;
+        this.nextMid.set(domain, mid + 1);
+        return { mid, seq: ++this.dealSeq };
+    }
+    // --- the DECLARED router (302 §5: declared, not derived) --------------------------------
+    //
+    // The user declares which mutators are room mutators; the client neither proves, derives,
+    // widens, nor falls back. The declaration reaches this backend as `domainPolicy` — the client
+    // layer resolves (mutator name, args) against its declared realtime mutators and the currently
+    // attached rooms. A misdeclaration fails SOFT (302 §5.1): a daemon-declared mutator touching
+    // room-visible data stages onto the daemon tables while the room-homed view reads the room
+    // tables — no optimistic feedback until the echo relays it a hop later, never a divergence.
+    // The room GATE stays the authoritative backstop: a room-routed mutation the room refuses comes
+    // back as a `mutationOutcome` deopt/reject frame and the H-v machinery below re-enqueues or
+    // surfaces it.
+    /** The declared confirming stream for one invocation: the `domainPolicy`'s verdict, `"daemon"`
+     *  when it abstains. Resolved BEFORE the prediction runs — the domain picks the staging map
+     *  (a room domain stages its owned tables onto the room's namespaced twins). */
+    resolveDomain(name, args) {
+        return this.domainPolicy(name, args) ?? "daemon";
+    }
+    /** The staging table map for a `domain`-routed prediction ({@link trackingTx}'s `stage`):
+     *  wire table → the room's namespaced engine table for the tables the room owns; identity for
+     *  everything else (including the whole map for the daemon domain). */
+    stagingMap(domain) {
+        return domain === "daemon" ? undefined : this.roomTables.get(domain);
+    }
+    /** The PLAIN (daemon-homed) engine AST for `ast` — aggregate relationships rewritten to their
+     *  synthetic `__agg_*` reads, no room renames. The ONE form every non-swapped engine
+     *  registration uses ({@link registerQuery}, {@link dropGhost}'s swap-back) and the base the
+     *  swap-in renames ({@link processSwapIns}). */
+    plainEngineAst(ast) {
+        return rewriteAggregates(ast, (t) => this.localTables.has(t));
+    }
+    /** Mutator names the cross-authority warn below already fired for (once per name). */
+    warnedCrossAuthority = new Set();
+    /** 302 §5.1 dev-time guard: a room-DECLARED mutator wrote tables the room does not own. Those
+     *  writes staged onto the PLAIN daemon tables (the staging map covers only owned tables), but
+     *  the entry confirms on the ROOM stream — and only the room's OWNED tables flush back to the
+     *  daemon, so nothing upstream ever echoes them: once the room confirm retires the entry, the
+     *  next release's whole-store rewind reverts them for good. The first-party room shell refuses
+     *  such a mutation (the §3.3 deopt/reject backstop re-routes it to the daemon), so this warns
+     *  for the shapes where that backstop may be absent (a BYO relay) — loud, once, soft (§5.1:
+     *  misdeclarations never throw). */
+    warnCrossAuthorityWrites(name, domain, touched) {
+        if (domain === "daemon" || this.warnedCrossAuthority.has(name))
+            return;
+        const map = this.roomTables.get(domain);
+        const staged = new Set(map?.values() ?? []);
+        const outside = [...touched].filter((t) => !staged.has(t));
+        if (outside.length === 0)
+            return;
+        this.warnedCrossAuthority.add(name);
+        console.warn(`[rindle] room mutator "${name}" wrote table(s) ${outside.join(", ")} that room ${JSON.stringify(domain)} does not own` +
+            ` (owned: ${map !== undefined && map.size > 0 ? [...map.keys()].join(", ") : "none"}) — these writes rely on the room` +
+            ` shell's deopt backstop and revert after the room confirm if the shell applies the mutation anyway (302 §5.1).`);
+    }
     /** Run the named client mutator optimistically: the prediction applies to the live
      *  engine now (affected views update synchronously), `(mid, name, args)` joins the
      *  pending stack, and the envelope ships upstream. Returns the assigned `mid`. */
     invoke(name, args) {
+        return this.invokeWith(name, args);
+    }
+    /** {@link invoke} with an optional PINNED confirming domain (H-v): the deopt handshake's
+     *  already-retired arm re-invokes the frame's echoed `(name, args)` as a FRESH invocation pinned
+     *  to `"daemon"` — an honest re-prediction on the current base, never derived (`pin` bypasses
+     *  {@link resolveDomain} entirely, so the router never runs and no Q6 counter moves). Every
+     *  other step is `invoke` verbatim: prediction now, capture, drainOverlapping, mid dealt from
+     *  the pinned domain's ledger, envelope on its channel. */
+    invokeWith(name, args, pin) {
         const mutator = this.registry[name];
         if (!mutator)
             throw new Error(`unknown client mutator: ${name}`);
         // One commit boundary spans the prediction AND the `__agg`-head reconcile below, so their views
         // (data + count) flush together rather than tearing across two engine commits.
         return this.inOneCommit(() => {
-            // Apply the prediction FIRST. If the mutator throws (client-side validation, a bad read),
+            // The confirming stream is DECLARED (302 §5), so it resolves BEFORE the prediction: the
+            // domain picks the staging map — a room-domain mutator's writes to the room's owned tables
+            // land on the namespaced engine twins the room-homed views read. An H-v deopt re-invocation
+            // pins via `pin` and the policy never runs.
+            const domain = pin ?? this.resolveDomain(name, args);
+            // Apply the prediction. If the mutator throws (client-side validation, a bad read),
             // the staged write is discarded (the wasm txn is a clean no-op until commit) and the throw
             // propagates with NO mid consumed — a burnt mid is a permanent server-side gap that
             // silently refuses every later mutation from this client (#10).
-            const touched = new Set();
+            const writes = new Map();
+            const reads = { reads: [], queries: [] };
             const ops = [];
             this.local.writeWith((tx) => {
-                this.runMutator(mutator, trackingTx(tx, touched, this.specs, this.localTables, this.opCollector(ops)), args);
+                this.runMutator(mutator, trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, reads, this.stagingMap(domain)), args);
             });
+            // `touched` is DERIVED, never separately populated (§3.2 #1) — see {@link WriteSet}.
+            const touched = new Set(writes.keys());
+            this.warnCrossAuthorityWrites(name, domain, touched);
             // Flush-on-enqueue (§4.2): a fold whose tables overlap this write must take its mid NOW, BEFORE
             // this write does, so wire order == local-apply order for any pair that can observe each other
             // (a read-dependent write reading a folded cell sees the same value optimistically and on the
             // wire — no snap). Drained folds ship with smaller mids; this write's mid is dealt after.
             this.drainOverlapping(touched);
-            const mid = this.nextMid++;
-            this.pendingMutations.push({ mid, name, args, touched });
+            // The confirming stream's ledger deals the mid and its watermark alone retires the entry
+            // (§7.1). An assigned mid pins its domain forever — a re-invocation never re-routes.
+            const { mid, seq } = this.dealMid(domain);
+            this.pendingMutations.push({ mid, seq, name, args, domain, touched, writes, reads });
             // The prediction stuck — fold its child ops into the optimistic agg delta and push it onto
             // the `__agg` head rows (§4). No reset here (this is the §1.3 trivial case, no rewind): the
             // delta accumulates on top of the prior pending set, and `reconcileAggHead` recomputes each
@@ -436,7 +1056,7 @@ export class OptimisticBackend {
                 this.overlay.observe(op);
             this.reconcileAggHead();
             this.refreshPending(); // §7.2: this write now touches its queries' pending axis (NOT ResultType).
-            void this.source.pushMutation({ clientID: this.clientID, mid, name, args });
+            void this.channelFor(domain).pushMutation({ clientID: this.clientID, mid, name, args });
             return mid;
         });
     }
@@ -451,15 +1071,19 @@ export class OptimisticBackend {
         const foldKey = `${name}\0${stableJson(opts.key)}`;
         // One commit boundary spans the prediction AND the `__agg`-head reconcile (see {@link inOneCommit}),
         // so a folded mutation's list view and count view flush together, never torn across two commits.
+        // The declared domain (302 §5) — resolved up front, like `invoke`'s: it picks the staging
+        // map, the §9.3 cadence, and the provisional confirming stream (the flush re-resolves).
+        const domain = this.resolveDomain(name, args);
         return this.inOneCommit(() => {
             // Apply the prediction with the read trap armed (§5): a folded mutator that reads state to
             // compute its write is non-absorbing and refused. A throw discards the staged write (clean
-            // no-op) and consumes no mid — exactly `invoke`'s guarantee.
-            const touched = new Set();
+            // no-op) and consumes no mid — exactly `invoke`'s guarantee. NO `readLog` here — the trap
+            // path stays byte-for-byte as it was; recording (§3.2 #2) never arms alongside the trap.
+            const writes = new Map();
             const ops = [];
             try {
                 this.local.writeWith((tx) => {
-                    this.runMutator(mutator, trackingTx(tx, touched, this.specs, this.localTables, this.opCollector(ops), true), args);
+                    this.runMutator(mutator, trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), true, undefined, this.stagingMap(domain)), args);
                 });
             }
             catch (e) {
@@ -471,19 +1095,33 @@ export class OptimisticBackend {
             for (const op of ops)
                 this.overlay.observe(op);
             this.reconcileAggHead();
+            // `touched` is DERIVED, never separately populated (§3.2 #1) — see {@link WriteSet}.
+            const touched = new Set(writes.keys());
+            this.warnCrossAuthorityWrites(name, domain, touched);
             const now = this.clock.now();
             let f = this.folds.get(foldKey);
             if (f) {
                 // Overwrite the single entry in place — the pending stack does NOT grow (§1 #2). The head
                 // already carries this new prediction (absorbing, last-wins on the cell); the entry holds
                 // only the LATEST args, which is what a rebase re-derives from and what the flush ships.
+                // `domain` too: THIS invocation staged through the freshly-resolved domain's map above, so
+                // a mid-window rebase must re-stage through the same one (the flush re-resolves anyway;
+                // no mid is pinned yet — `entry.mid` is null until flush).
                 f.entry.args = args;
                 f.entry.touched = touched;
+                f.entry.writes = writes;
+                f.entry.domain = domain;
                 f.args = args;
                 this.clock.clearTimeout(f.timer);
             }
             else {
-                const entry = { mid: null, name, args, touched };
+                // §9.3: pick the window's cadence. Routing into a room ⇒ flush at roomDebounceMs so
+                // intermediates stream to the shared head; off the room, the caller's collapse debounce
+                // governs.
+                const inRoom = opts.roomDebounceMs !== undefined && domain !== "daemon";
+                const debounceMs = inRoom ? opts.roomDebounceMs : opts.debounceMs ?? DEFAULT_FOLD_DEBOUNCE_MS;
+                const maxWaitMs = inRoom ? opts.roomDebounceMs : opts.maxWaitMs;
+                const entry = { mid: null, seq: null, name, args, domain, touched, writes, reads: { reads: [], queries: [] } };
                 this.pendingMutations.push(entry);
                 let resolveMid;
                 const midPromise = new Promise((res) => (resolveMid = res));
@@ -492,8 +1130,8 @@ export class OptimisticBackend {
                     args,
                     timer: undefined,
                     firstAt: now,
-                    debounceMs: opts.debounceMs ?? DEFAULT_FOLD_DEBOUNCE_MS,
-                    maxWaitMs: opts.maxWaitMs,
+                    debounceMs,
+                    maxWaitMs,
                     deferAcrossWrites: opts.deferAcrossWrites ?? false,
                     midPromise,
                     resolveMid,
@@ -535,11 +1173,163 @@ export class OptimisticBackend {
             return;
         this.clock.clearTimeout(f.timer);
         this.folds.delete(foldKey);
-        const mid = this.nextMid++;
+        // Re-resolve the DECLARED confirming stream from the FINAL args (§7.1) and deal the mid from
+        // that domain's ledger — SEND order, never reserved, so gapless within the domain. The mid
+        // dealt below then pins this domain. (A domain that changed since the window opened — a room
+        // attached or dropped mid-window — re-stages on the next reconcile's re-invocation.)
+        const domain = this.resolveDomain(f.entry.name, f.args);
+        f.entry.domain = domain;
+        const { mid, seq } = this.dealMid(domain);
         f.entry.mid = mid;
-        void this.source.pushMutation({ clientID: this.clientID, mid, name: f.entry.name, args: f.args });
+        f.entry.seq = seq;
+        void this.channelFor(domain).pushMutation({ clientID: this.clientID, mid, name: f.entry.name, args: f.args });
         f.resolveMid(mid);
     }
+    /** The transport a `domain`-confirmed mutation ships on (§7.5 sent-pins-domain: only the
+     *  domain's own authority can confirm it, so its channel is the only correct transport). A
+     *  domain with NO connected gate ships on the daemon channel — the gate-less configurations
+     *  (`__testRelease`-driven tests) and today's entire live path resolve `"daemon"` anyway. */
+    channelFor(domain) {
+        return (this.gates.get(domain) ?? this.daemonGate).source;
+    }
+    /** The gate a channel-keyed retain registers through (G-iii registration-time routing). The
+     *  channel MUST already be connected (`connectSource`; the daemon is constructor-attached) —
+     *  loud by design: a typo'd or not-yet-connected sourceKey must throw at retain time, never
+     *  silently register on the daemon and split the query's frames across channels. */
+    requireGate(channel) {
+        const gate = this.gates.get(channel);
+        if (!gate) {
+            throw new Error(`optimistic backend: no source connected for channel ${JSON.stringify(channel)} — call connectSource(${JSON.stringify(channel)}, source) before retaining a query on it`);
+        }
+        return gate;
+    }
+    /** The channel that owns `sourceQid` — {@link RemoteSub.channel}, the ONE source of truth for
+     *  qid routing (G-iii). `undefined` when no sub owns the qid (a harness-delivered raw feed, or
+     *  a just-released sub): such frames buffer on whatever gate they arrive at. */
+    channelOf(sourceQid) {
+        const key = this.sourceToRemote.get(sourceQid);
+        return key ? this.remoteSubs.get(key)?.channel : undefined;
+    }
+    // --- the §3.3 deopt handshake, client half (H-v) ---------------------------------
+    //
+    // THE NAMED INVARIANT (Slice I inherits it): **never retire a room-domain entry off a
+    // daemon-carried lmid without outcome resolution.** On the room socket it holds by
+    // construction: every room lmid folds through the room's OWN gate, whose socket also carries
+    // the outcome frames — same-socket ordering puts the frame before the ack, and the reconnect
+    // re-send re-earns a lost frame, so a room-domain entry is only ever retired as a success when
+    // the room really applied it. Slice I's downgrade path breaks that coupling: the doc-scoped
+    // ledger row becomes readable THROUGH THE DAEMON with no room socket alive (§7.1 "load-bearing
+    // for §7.5"), and an lmid adopted that way covers burnt non-applied mids with no frame to say
+    // so — retiring a deopted entry there as a silent success is exactly the lost-write this
+    // handshake exists to prevent. ENFORCED since I-iii by {@link foldSystemFrames}: the I-ii
+    // outcome ROWS (co-committed, in ONE daemon transaction, with the ledger row that covers them)
+    // are synthesized into frames and routed through THIS machine BEFORE the ledger fold advances
+    // the domain watermark — one verdict path for frames and rows, with the processed set as the
+    // cross-release resolved-verdict memory, and absence-under-a-covering-lmid = applied (I-ii's
+    // atomicity makes that the sound default).
+    /** Record `(domain, mid)` as processed; `false` if it already was (a duplicate frame —
+     *  ignore it). FIFO-capped per domain ({@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}). */
+    markOutcomeProcessed(domain, mid) {
+        let mids = this.outcomesProcessed.get(domain);
+        if (!mids)
+            this.outcomesProcessed.set(domain, (mids = new Set()));
+        if (mids.has(mid))
+            return false;
+        mids.add(mid);
+        while (mids.size > MAX_PROCESSED_OUTCOMES_PER_DOMAIN) {
+            mids.delete(mids.values().next().value);
+        }
+        return true;
+    }
+    /** One `mutationOutcome` frame from `domain`'s channel (H-v — the §3.3 handshake's client
+     *  half). The frame arrives OUT-OF-BAND (see {@link attachGate}); the state machine:
+     *
+     *  1. `mid` never issued on `domain` ⇒ ignore (a confused/foreign frame must not invent work).
+     *  2. `(domain, mid)` already processed ⇒ ignore — idempotence under duplicate frames (the
+     *     original + a re-send's re-answer; a deopt for a mid whose entry ALREADY FLIPPED also
+     *     lands here harmlessly on its second frame).
+     *  3. `kind:"rejected"` ⇒ FINAL. Surface the reason through {@link rejectedHandler} (room-plane
+     *     parity with the HTTP queue's callback) and STOP — the drop + snap-back is the EXISTING
+     *     failed-mutation machinery: the room burnt the mid, its lmid release retires the entry
+     *     per-domain and the reconcile rewinds the prediction, exactly the daemon path's
+     *     processed-as-no-op rejection. No new drop path.
+     *  4. `kind:"deopt"`, entry found (pending `(domain, mid)`) ⇒ FLIP IN PLACE: `domain` becomes
+     *     `"daemon"`, a fresh daemon mid is dealt and the envelope ships NOW on the daemon channel
+     *     ("deal-and-send-now" — the conforming §3.3 re-enqueue: there is no flush machinery for
+     *     non-fold entries, so the design's "mid: null until the daemon flush" is satisfied
+     *     momentarily inside this call). THE ENTRY'S `seq` IS KEPT — settled (§5.3, commit
+     *     68141096): `seq` is the client-global REPLAY order; re-sequencing would move the entry's
+     *     overlay position and change read-dependent SIBLINGS' replay base. Everything else stays
+     *     (writes/reads/touched/touchedSources/writeSources — union-never-shrink), the prediction
+     *     stays applied (the entry never leaves `pendingMutations`, so no rewind fires), and the
+     *     router does NOT re-run nor does `drainOverlapping` (§3.3 re-enqueues, never re-derives;
+     *     any open overlapping fold was invoked later and flushes later with a larger mid).
+     *  5. `kind:"deopt"`, entry NOT found ⇒ the burnt-mid confirm won the race, or the frame is a
+     *     replay re-answer for an entry a previous session retired (the replay gotcha): re-invoke
+     *     the frame's echoed `name`/`args` as a FRESH invocation PINNED to `"daemon"` — an honest
+     *     re-prediction on the current base, never a derived route ({@link invokeWith}). A frame
+     *     without `name` (not self-contained) has nothing to re-invoke and is dropped; a re-invoke
+     *     that THROWS (the base moved from under it) is surfaced through {@link rejectedHandler} —
+     *     the mutation is dead with no stream left to confirm it.
+     *
+     *  A `"deopt"` bump joins the Q6 routing counters either way (`routing.reasons.deopt`) —
+     *  derived-and-deopted routes are visible beside derived successes. */
+    handleMutationOutcome(domain, frame) {
+        if (frame.mid >= (this.nextMid.get(domain) ?? 1))
+            return; // never issued here — not ours
+        if (!this.markOutcomeProcessed(domain, frame.mid))
+            return; // duplicate frame
+        if (frame.kind === "rejected") {
+            const entry = this.pendingMutations.find((p) => p.domain === domain && p.mid === frame.mid);
+            this.rejectedHandler({
+                clientID: this.clientID,
+                mid: frame.mid,
+                name: entry?.name ?? frame.name ?? "",
+                args: entry !== undefined ? entry.args : frame.args,
+            }, frame.reason ?? "mutation rejected");
+            return;
+        }
+        // kind === "deopt": the room gate refused a declared-room mutation — re-enqueue onto the daemon.
+        const entry = this.pendingMutations.find((p) => p.domain === domain && p.mid === frame.mid);
+        if (entry) {
+            entry.domain = "daemon";
+            // Deal the fresh daemon mid but DISCARD its seq — the entry keeps its own (state-machine
+            // step 4 above; the harmless dealSeq bump is accepted). This is the ONE place a dealt seq
+            // is dropped, so "within one domain seq order == mid order" weakens to "except deopt
+            // re-enqueues" — see the {@link PendingMutation.seq} doc.
+            const { mid } = this.dealMid("daemon");
+            entry.mid = mid;
+            void this.channelFor("daemon").pushMutation({ clientID: this.clientID, mid, name: entry.name, args: entry.args });
+            return;
+        }
+        if (frame.name === undefined)
+            return; // not self-contained — nothing to re-invoke
+        try {
+            this.invokeWith(frame.name, frame.args, "daemon");
+        }
+        catch (err) {
+            this.rejectedHandler({ clientID: this.clientID, mid: frame.mid, name: frame.name, args: frame.args }, `deopt re-invocation failed: ${String(err?.message ?? err)}`);
+        }
+    }
+    /** §7.5 rule 3 (H-v): re-send `domain`'s unconfirmed pending envelopes with their ORIGINAL
+     *  mids, in mid order, on the domain's own channel. Folds with `mid === null` are excluded —
+     *  nothing was ever sent for them (the flush deals their mid). Envelopes are reconstructed from
+     *  the pending entries exactly as `invoke` shipped them (`clientID`/`mid`/`name`/`args` —
+     *  entries carry everything the wire needs). Idempotent under the domain's ledger: an APPLIED
+     *  mid dedups silently and its lmid coverage retires the entry; a NON-APPLIED mid is re-answered
+     *  from the shell's recorded-outcome map into {@link handleMutationOutcome}. Confirmed entries
+     *  are already gone from `pendingMutations`, so no filter against the watermark is needed. */
+    resendPending(domain) {
+        const unconfirmed = this.pendingMutations
+            .filter((p) => p.domain === domain && p.mid !== null)
+            .sort((a, b) => a.mid - b.mid);
+        if (unconfirmed.length === 0)
+            return;
+        const channel = this.channelFor(domain);
+        for (const p of unconfirmed) {
+            void channel.pushMutation({ clientID: this.clientID, mid: p.mid, name: p.name, args: p.args });
+        }
+    }
     /** Drain every outstanding fold immediately (FOLDED-MUTATIONS-DESIGN §3): the explicit
      *  `app.flushFolds()` and the `beforeunload`/`close` hook. Creation (insertion) order. */
     flushFolds() {
@@ -638,7 +1428,19 @@ export class OptimisticBackend {
         const pending = this.pendingMutations.map((p) => {
             const folded = foldByEntry.get(p);
             const key = p.mid != null ? `m:${p.mid}` : folded ? `f:${folded[0]}` : `?:${p.name}`;
-            const out = { key, mid: p.mid, name: p.name, args: p.args, tables: [...p.touched] };
+            const writes = [];
+            for (const byPk of p.writes.values())
+                for (const rec of byPk.values())
+                    writes.push(rec);
+            const out = {
+                key,
+                mid: p.mid,
+                name: p.name,
+                args: p.args,
+                tables: [...p.touched],
+                writes,
+                reads: { reads: [...p.reads.reads], queries: [...p.reads.queries] },
+            };
             if (folded) {
                 const f = folded[1];
                 out.fold = {
@@ -653,13 +1455,41 @@ export class OptimisticBackend {
         });
         return {
             pending,
-            confirmedLmid: this.confirmedLmid,
-            nextMid: this.nextMid,
-            appliedCv: this.appliedCv,
-            bufferedFrames: this.buffer.length,
+            // Back-compat scalars for the devtools `OptimisticInspect` mirror (unchanged shape): the DAEMON
+            // domain's ledger — the only one in single-domain. Per-domain state is `__inspectDomains()`.
+            confirmedLmid: this.watermark.get("daemon") ?? 0,
+            nextMid: this.nextMid.get("daemon") ?? 1,
+            appliedCv: this.daemonGate.appliedCv,
+            bufferedFrames: this.daemonGate.buffer.length,
             pendingTables: [...this.pendingTables()],
         };
     }
+    /** Test-only per-domain ledger snapshot (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1/§8.5).
+     *  Kept separate from {@link __inspect} so the devtools `OptimisticInspect` mirror stays byte-for-
+     *  byte identical (daemon-scalar-only). Exposes the per-domain `nextMid`/`watermark` maps plus each
+     *  pending entry's confirming domain — the axes the §8.5 ledger-isolation assertion checks. */
+    __inspectDomains() {
+        return {
+            nextMid: Object.fromEntries(this.nextMid),
+            watermark: Object.fromEntries(this.watermark),
+            gates: Object.fromEntries([...this.gates].map(([k, g]) => [k, { appliedCv: g.appliedCv, bufferedFrames: g.buffer.length }])),
+            roomTables: Object.fromEntries([...this.roomTables].map(([k, m]) => [k, Object.fromEntries(m)])),
+            swappedViews: Object.fromEntries(this.roomSwappedViews),
+            lifecycle: {
+                roomWatermarks: Object.fromEntries(this.roomWatermarks),
+                scopeSessions: Object.fromEntries([...this.scopeSessions].map(([scope, sessions]) => [scope, Object.fromEntries(sessions)])),
+                ghosts: Object.fromEntries([...this.ghosts].map(([k, g]) => [k, { doc: g.doc, finalFlushSeq: g.finalFlushSeq }])),
+            },
+            pending: this.pendingMutations.map((p) => ({
+                mid: p.mid,
+                // The client-global deal sequence — the REPLAY order (mids are per-domain, incomparable
+                // across domains; see PendingMutation.seq). The harness asserts send order with this.
+                seq: p.seq,
+                name: p.name,
+                domain: p.domain,
+            })),
+        };
+    }
     /** Recompute the pending axis for every query and fire `onPending` on transitions only. Called
      *  from the two points that move the pending set: invoke/invokeFolded (add) and the confirm-drop
      *  (remove) — exactly where `:359`/`:468` used to flip ResultType (§7.3). */
@@ -672,18 +1502,39 @@ export class OptimisticBackend {
             }
         }
     }
-    // --- the downstream stream (§8.5: buffer, then release coherently) ---------------
-    onNormalized(qid, ev) {
-        if (qid !== LMID_QID)
+    // --- the downstream stream (§8.5: buffer, then release coherently — PER GATE, §5.1) ------
+    onFrame(gate, qid, ev) {
+        // Ownership is fixed at RETAIN time (G-iii registration-time routing: {@link RemoteSub.channel},
+        // the one source of truth) — a qid lives on the ONE channel its sub registered on. So a frame
+        // arriving on any OTHER gate means the server routed a qid to the wrong channel: a wiring bug —
+        // fail loudly rather than silently splitting one query's frames across two cv timelines. (This
+        // used to be a lazy first-arrival CLAIM; it is now a pure assertion.) A qid with NO sub (a
+        // harness-delivered raw feed) has no owner and buffers on the arriving gate; the per-channel
+        // reserved LMID_QID is exempt — each gate owns its own.
+        if (qid !== LMID_QID) {
+            const owner = this.channelOf(qid);
+            if (owner !== undefined && owner !== gate.key) {
+                // I-iv retarget grace: a frame already in flight from the sub's PREVIOUS channel when
+                // {@link retargetRemoteQuery} moved it (the unsubscribe races the server's last frames)
+                // is stale, not a wiring bug — drop it. The grace window is exactly the deferred-GC
+                // window: {@link flushRetargetGc} deletes the record, and the loud throw is restored.
+                if (this.pendingRetargetGc.get(qid) === gate.key)
+                    return;
+                throw new Error(`optimistic backend: qid ${qid} arrived on ${gate.key} but is owned by ${owner}`);
+            }
+        }
+        // System-plane frames (I-iii) are bookkeeping, not view data: like the lmid stream they skip
+        // the devtools server-delta tap (there is no local view to attribute them to).
+        if (qid !== LMID_QID && !this.systemQids.has(qid))
             this.emitServerDelta(qid, ev);
         if (ev.type === "hello") {
             // A hello is a (re)subscribe = a NEW epoch. The column map below is mutated eagerly, but
-            // data frames are cv-buffered and drained later (onProgress). So any frame still buffered
-            // for this qid is from a SUPERSEDED epoch and must NOT be scattered through this epoch's
-            // (possibly changed) map — drop it. This epoch's snapshot, which always follows the hello,
-            // re-hydrates the qid from scratch, so the dropped frames are redundant. Scoped to this
-            // qid: other queries' frames (and the lmid system query's) keep their coherent release.
-            this.buffer = this.buffer.filter((f) => f.qid !== qid);
+            // data frames are cv-buffered and drained later (the gate's progress). So any frame still
+            // buffered for this qid is from a SUPERSEDED epoch and must NOT be scattered through this
+            // epoch's (possibly changed) map — drop it. This epoch's snapshot, which always follows the
+            // hello, re-hydrates the qid from scratch, so the dropped frames are redundant. Scoped to
+            // this qid: other queries' frames (and the lmid system query's) keep their coherent release.
+            gate.buffer = gate.buffer.filter((f) => f.qid !== qid);
             this.addServerDependencyTables(qid, ev.tables.map((t) => t.name));
             // Learn this query's per-table column map (PROJECTION-SUPPORT-DESIGN.md §5.2): map each
             // advertised column to its base ColId BY NAME. The hello may carry FEWER columns than the
@@ -703,18 +1554,18 @@ export class OptimisticBackend {
                 // epoch left (a server that expanded then contracted back), so the now-exact rows don't
                 // scatter through a `-1`-bearing layout (silent cell corruption).
                 if (cols.length !== full || cols.some((c, i) => c !== i))
-                    this.sync.registerProjection(qid, t.name, cols);
+                    gate.sync.registerProjection(qid, t.name, cols);
                 else
-                    this.sync.unregisterProjection(qid, t.name);
+                    gate.sync.unregisterProjection(qid, t.name);
             }
             return; // envelope validation is the source's job
         }
         const cv = ev.cv ?? 0;
-        if (cv <= this.appliedCv && ev.type === "batch")
-            return; // stale redelivery
-        this.buffer.push({ cv, qid, kind: ev.type, ops: ev.ops, seq: this.nextSeq++ });
-        if (this.buffer.length > this.bufferCap)
-            this.overflow();
+        if (cv <= gate.appliedCv && ev.type === "batch")
+            return; // stale redelivery ON THIS TIMELINE
+        gate.buffer.push({ cv, qid, kind: ev.type, ops: ev.ops, seq: gate.nextSeq++ });
+        if (gate.buffer.length > this.bufferCap)
+            this.overflow(gate);
     }
     emitServerDelta(sourceQid, ev) {
         if (!this.devObservers.size)
@@ -732,86 +1583,427 @@ export class OptimisticBackend {
         const localQids = [...sub.localQids.keys()];
         return localQids.length ? localQids : [sourceQid];
     }
-    onProgress(frame) {
+    /** One gate's release (§5.1 release gate): compute the coherent delta from THIS gate's cv-buffer,
+     *  then apply it against the gate's source/domain. Split into {@link computeRelease} (buffer →
+     *  delta, lmid → watermark) and {@link applyRelease} (per-source confirm-drop + reconcile) —
+     *  N independent gates all feed the ONE apply half; {@link __testRelease} drives it directly. */
+    onGateProgress(gate, frame) {
+        const { deltas, newlyHydrated, touchedScopes } = this.computeRelease(gate, frame);
+        this.applyRelease(gate.key, deltas, undefined, newlyHydrated);
+        // I-iv phase 2: a retargeted sub whose first ROOM snapshot released just now gets its old
+        // channel's rows GC'd — AFTER the release fully applied, so the winner flip is value-equal
+        // against the freshly-folded room rows (never a remove-before-the-refill).
+        this.flushRetargetGc(gate);
+        // I-iv doorbell events LAST — everything this release carried (data, confirms, the occupancy
+        // fold itself, the retarget cutover) is already applied when the consumer's reaction (an
+        // async re-lease) is kicked off. One event per touched scope, count evaluated at the fold
+        // clock's now (deterministic under an injected clock).
+        if (touchedScopes !== null) {
+            for (const scope of touchedScopes) {
+                this.scopeSessionsHandler({ scope, others: this.otherScopeSessions(scope) });
+            }
+        }
+    }
+    /** Compute one coherent release from ONE gate's cv-buffer (§5.1) — gate-scoped: its buffer, its
+     *  cvMin timeline. Take every buffered frame at `cv ≤ cvMin`, in (cv, arrival) order, and fold
+     *  it: the lmid system-query frame advances `watermark[gate.key]` (via {@link foldLmidOps} — the
+     *  daemon stream folds "daemon", a room stream folds its own domain); data frames fold through
+     *  this SOURCE's cross-query refcount into ONE net base delta — the §1.3 `D`. Returns that delta
+     *  plus the set of local views this release JUST hydrated (so their reconcile batch phases as a
+     *  `snapshot`). Mutates the gate's buffer/`appliedCv`, hydration, and the gate's domain
+     *  watermark; the pending set and the reconcile are {@link applyRelease}'s job. */
+    computeRelease(gate, frame) {
         // Snapshot which local views are already hydrated BEFORE this release folds: any that cross into
         // hydrated below get their first result set as this cycle's batch, which must phase as a snapshot.
         const wasHydrated = new Set(this.hydrated);
-        // (1) Take every buffered frame at cv ≤ cvMin, in (cv, arrival) order, and fold it:
-        // lmid system-query frames advance `confirmedLmid`; data frames fold through the
-        // cross-query refcount into ONE net base delta — the §1.3 `D`. Confirmation and
-        // data of the same commit share a cv, so they release together by construction.
-        const ready = this.buffer
+        const ready = gate.buffer
             .filter((f) => f.cv <= frame.cvMin)
             .sort((a, b) => a.cv - b.cv || a.seq - b.seq);
-        this.buffer = this.buffer.filter((f) => f.cv > frame.cvMin);
+        gate.buffer = gate.buffer.filter((f) => f.cv > frame.cvMin);
+        // The §4 lifecycle SYSTEM frames fold FIRST, in a FIXED structural category order (Slice
+        // I-iii; see {@link foldSystemFrames} for why the order is load-bearing), then the ordinary
+        // lmid + data frames fold exactly as before. With no system retain the partition is empty and
+        // this release is byte-identical to pre-I-iii. The returned scope set feeds the I-iv doorbell
+        // events `onGateProgress` fires once the WHOLE release has applied.
+        const touchedScopes = this.foldSystemFrames(ready.filter((f) => this.systemQids.has(f.qid)));
         const muts = [];
         for (const f of ready) {
+            if (this.systemQids.has(f.qid)) {
+                // Folded above; a system stream has no store view and MUST NOT enter the sync layer (its
+                // tables are not in the schema) — but its first snapshot still marks the sub hydrated so
+                // the overflow/introspection bookkeeping stays uniform.
+                if (f.kind === "snapshot")
+                    this.markSubHydrated(f.qid);
+                continue;
+            }
             if (f.qid === LMID_QID) {
-                this.foldLmidOps(f.ops);
+                // Confirmation and data of the same commit share a cv, so they release together — each
+                // channel's lmid stream folds into ITS OWN domain's watermark (§7.1).
+                this.foldLmidOps(f.ops, gate.key);
                 continue;
             }
-            muts.push(...(f.kind === "snapshot" ? this.sync.rehydrate(f.qid, f.ops) : this.sync.applyBatch(f.qid, f.ops)));
+            // A ROOM gate's deltas rename into the room's namespaced tables — and a wire table outside
+            // the registered map is DROPPED (302 §6: context comes from the daemon, one authority per
+            // table; a room's relayed context copy must never enter the store).
+            muts.push(...mapGateDeltas(gate, f.kind === "snapshot" ? gate.sync.rehydrate(f.qid, f.ops) : gate.sync.applyBatch(f.qid, f.ops)));
             // A query's first released snapshot is its hydration point — even an empty one (0 rows is an
             // authoritative answer): lift every local view this sub feeds out of `unknown` (loading).
             if (f.kind === "snapshot")
                 this.markSubHydrated(f.qid);
         }
-        this.appliedCv = Math.max(this.appliedCv, frame.cvMin);
-        // (2) Drop confirmed pending (§1.3 step 5's bookkeeping half): mid ≤ the lmid this
-        // release itself delivered. A failed mutation drops the same way — the release just
-        // carries no effects for it, so the rewind in (3) snaps the prediction back. An UNFLUSHED
-        // folded entry (`mid == null`) is never confirmable — it has not crossed the wire — so it is
-        // always retained until its own flush stamps a real mid (FOLDED-MUTATIONS-DESIGN §4.1).
+        gate.appliedCv = Math.max(gate.appliedCv, frame.cvMin);
+        let newlyHydrated = null;
+        for (const qid of this.hydrated) {
+            if (!wasHydrated.has(qid))
+                (newlyHydrated ??= new Set()).add(qid);
+        }
+        return { deltas: muts, newlyHydrated, touchedScopes };
+    }
+    /** Apply one released delta against `sourceKey`'s domain (§7.2 per-domain confirm-drop + the §1.3
+     *  reconcile cycle). `watermarkUpdate`, when given, advances `watermark[sourceKey]` first — the
+     *  hook a per-source lmid confirm rides on (the daemon path folds its watermark in
+     *  {@link computeRelease} and passes `undefined`). Then: drop every pending entry its OWN domain's
+     *  watermark now covers (a room confirm can never retire a daemon entry, and vice-versa — the §7.1
+     *  ledger-collision fix), and run the reconcile cycle against `sourceKey` when the base delta or the
+     *  pending set changed. `newlyHydrated` stamps the initial-hydration batch as a catch-up. */
+    applyRelease(sourceKey, deltas, watermarkUpdate, newlyHydrated = null) {
+        if (watermarkUpdate !== undefined) {
+            this.watermark.set(sourceKey, Math.max(this.watermark.get(sourceKey) ?? 0, watermarkUpdate));
+        }
+        // Drop confirmed pending (§1.3 step 5's bookkeeping half), PER DOMAIN: an entry is retired only
+        // when ITS domain's watermark reaches its mid — so two concurrent streams never alias one counter
+        // (§7.1). A failed mutation drops the same way (the release carries no effects, so the rewind snaps
+        // the prediction back). An UNFLUSHED fold (`mid == null`) is never confirmable — retained until its
+        // flush stamps a real mid (FOLDED-MUTATIONS-DESIGN §4.1), regardless of any domain's watermark.
+        // H-v NOTE — retiring here treats coverage as SUCCESS, which for a room domain is sound only
+        // because outcome resolution ALWAYS precedes the coverage that retires: on the room socket
+        // the outcome frames outrun the lmid acks (same-socket ordering + the resync re-send), and on
+        // the daemon-carried path (I-iii) `foldSystemFrames` routes the co-committed outcome ROWS
+        // through handleMutationOutcome BEFORE the ledger fold advances the watermark this filter
+        // reads — a deopted entry has already flipped off the domain by the time its burnt mid is
+        // covered, either way (the named invariant above handleMutationOutcome).
         const before = this.pendingMutations.length;
-        this.pendingMutations = this.pendingMutations.filter((p) => p.mid === null || p.mid > this.confirmedLmid);
+        this.pendingMutations = this.pendingMutations.filter((p) => p.mid === null || p.mid > (this.watermark.get(p.domain) ?? 0));
         const pendingChanged = this.pendingMutations.length !== before;
-        // (3) The reconcile cycle — only when something can have changed: a base delta to
-        // fold in, or a pending set that shrank (its optimistic layer must rewind out). The batch it
-        // emits for any view that JUST became hydrated is that view's initial result set, so mark those
-        // qids so the local-event forwarder stamps their batch `catchUp` (→ Store phases it `snapshot`).
-        if (muts.length || pendingChanged) {
-            let newlyHydrated = null;
-            for (const qid of this.hydrated) {
-                if (!wasHydrated.has(qid))
-                    (newlyHydrated ??= new Set()).add(qid);
-            }
+        // The reconcile cycle — only when something can have changed: a base delta to fold in, or a
+        // pending set that shrank (its optimistic layer must rewind out). The batch it emits for any view
+        // that JUST became hydrated is that view's initial result set, so mark those qids so the
+        // local-event forwarder stamps their batch `catchUp` (→ Store phases it `snapshot`).
+        if (deltas.length || pendingChanged) {
+            const emitted = (this.catchUpEmitted = new Set());
             this.catchUpQids = newlyHydrated;
             try {
-                this.runReconcileCycle(muts);
+                this.runReconcileCycle(sourceKey, deltas);
             }
             finally {
                 this.catchUpQids = null;
+                this.catchUpEmitted = null;
             }
+            // Drop the qids the reconcile actually delivered a batch for; the rest folded nothing.
+            if (newlyHydrated)
+                for (const qid of emitted)
+                    newlyHydrated.delete(qid);
         }
-        // (4) ResultType is the SERVER CHANNEL's state only now (§7): `unknown` while not hydrated,
-        // else `complete` — a pending mutation no longer moves it. The pending axis moves separately.
+        // ResultType is the SERVER CHANNEL's state only now (§7): `unknown` while not hydrated, else
+        // `complete` — a pending mutation no longer moves it. The pending axis moves separately.
         for (const qid of this.queryTables.keys()) {
             this.setResultType(qid, this.hydrated.has(qid) ? "complete" : "unknown");
         }
+        // A newly-hydrated query whose reconcile emitted NO batch (0 rows, its whole result already present
+        // via a sibling → 0 net muts, or the reconcile was skipped) still needs a hydration signal, or its
+        // SSR seed never retires and the view freezes. Send an explicit empty catch-up (now that it reads
+        // `complete`, the Store retires the seed and reveals whatever is already in its tree).
+        if (newlyHydrated) {
+            for (const qid of newlyHydrated)
+                this.handler(qid, { type: "batch", events: [], catchUp: true });
+        }
         this.refreshPending();
+        // The 302 §4.1 swap-in — strictly AFTER the reconcile above folded this release's data, so a
+        // room sub whose first snapshot just released swaps its views onto room tables that already
+        // hold the snapshot (swapping earlier would hydrate them empty). Structural no-op with no
+        // pending swap (every single-domain client).
+        this.processSwapIns();
+        // The I-v ghost-drop watcher (§4.2), LAST: this release's watermark rows have folded
+        // (computeRelease) and its confirm-drop has retired what it covers — exactly the two inputs
+        // the drop condition reads. Structural no-op with no ghost.
+        this.evaluateGhosts();
+    }
+    /** Test-only per-source release seam (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.2/§8.5): drive
+     *  {@link applyRelease} for `sourceKey` directly — an explicit `watermarkUpdate` (a simulated lmid
+     *  confirm for that domain) and `deltas` (a coherent base delta), with no real gate. Lets a harness
+     *  exercise a room-domain confirm before the real second lmid stream / per-source gate is wired
+     *  (E-iii-b/c). The `__`-prefix marks it a test hook, alongside {@link __inspect}. */
+    __testRelease(sourceKey, deltas, watermarkUpdate) {
+        this.applyRelease(sourceKey, deltas, watermarkUpdate);
     }
-    /** Fold the lmid system query's released ops (lmid-as-data): the one row's
-     *  `last_mutation_id` cell is this client's confirmed high-water mid. */
-    foldLmidOps(ops) {
+    // --- the 302 §4 swap-in ------------------------------------------------------------------
+    /** Swap every view of each just-hydrated ROOM sub onto the room's namespaced tables (302 §4.1):
+     *  re-register the local engine query with the AST's room-owned table references renamed
+     *  ({@link remapAstTables}); the Store folds the re-hello as an in-place reset, so the caller's
+     *  view reference survives and subscribers see ONE transition. Runs at the applyRelease tail —
+     *  the reconcile has already folded the sub's snapshot into the room tables, so the swapped
+     *  view hydrates straight to the room state (swapping earlier would flash it empty). The
+     *  ORIGINAL ast stays in {@link asts}; the swap-back ({@link dropGhost}) re-registers it.
+     *
+     *  This is the accepted-flash boundary (302 §4.1/§7.1): the room's copy may be behind the
+     *  daemon rows the view showed a moment ago — accepted by decision, revisit on a real
+     *  two-region deploy. */
+    processSwapIns() {
+        if (this.pendingSwapIns.size === 0)
+            return; // every single-domain release: structural no-op
+        const subs = [...this.pendingSwapIns];
+        this.pendingSwapIns.clear();
+        this.inOneCommit(() => {
+            for (const sub of subs) {
+                const map = this.roomTables.get(sub.channel);
+                for (const qid of sub.localQids.keys()) {
+                    const ast = this.asts.get(qid);
+                    if (ast === undefined)
+                        continue;
+                    // 302 §6.1 coverage check, BEFORE the owned-table gate (an all-context room swaps
+                    // nothing yet still starves every ref): any referenced table the room does not own
+                    // keeps reading the PLAIN daemon tables after the swap — legal (the client-side join
+                    // across kinds), but the rows render only if a daemon subscription covers them, which
+                    // is unknowable here. Surface once per view, loudly, so a silently-empty join is a
+                    // named condition. Local-only tables are daemon-free by definition — skip them.
+                    if (!this.contextJoinWarned.has(qid)) {
+                        const uncovered = [...collectTables(ast)].filter((t) => !(map?.has(t) ?? false) && !this.localTables.has(t));
+                        if (uncovered.length > 0) {
+                            this.contextJoinWarned.add(qid);
+                            this.roomContextJoinHandler({ sourceKey: sub.channel, name: sub.remote.name, args: sub.remote.args, tables: uncovered });
+                        }
+                    }
+                    if (map === undefined || map.size === 0)
+                        continue; // no owned tables — nothing to swap
+                    if (this.roomSwappedViews.get(qid) === sub.channel)
+                        continue; // already swapped
+                    const rewritten = remapAstTables(this.plainEngineAst(ast), map);
+                    this.local.unregisterQuery(qid);
+                    this.local.registerQuery(qid, rewritten);
+                    this.roomSwappedViews.set(qid, sub.channel);
+                    // The pending axis follows the engine tables the view now reads (union — the wire
+                    // names stay too, conservatively: a daemon-declared write to a room-visible table is
+                    // still an honest "pending elsewhere" signal).
+                    const tables = this.queryTables.get(qid);
+                    if (tables)
+                        for (const t of map.values())
+                            tables.add(t);
+                }
+            }
+        });
+    }
+    /** Fold `domain`'s lmid system query's released ops (lmid-as-data): the one row's
+     *  `last_mutation_id` cell is this client's confirmed high-water mid in that domain — it advances
+     *  `watermark[domain]` and, on a fresh session ahead of our issued mids, `nextMid[domain]`. The
+     *  daemon stream folds `"daemon"`; a room stream folds its own `"room:doc:X"`; the daemon-carried
+     *  §7.1 ledger rows fold through the same {@link foldConfirm} core (Slice I-iii). */
+    foldLmidOps(ops, domain) {
         for (const op of ops) {
             const row = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
             if (!row)
                 continue; // a remove (client GC) confirms nothing
-            const lmid = Number(row[1]);
-            if (!Number.isFinite(lmid))
-                continue;
-            if (lmid > this.nextMid - 1) {
-                if (this.pendingMutations.length > 0) {
-                    // The server confirmed a mid we never issued while we have mutations in
-                    // flight — two writers on one clientID or corrupted state. Unrecoverable.
-                    throw new Error(`optimistic backend: confirmed lmid ${lmid} is ahead of issued mids (${this.nextMid - 1})`);
+            this.foldConfirm(domain, Number(row[1]));
+        }
+    }
+    /** THE one confirm fold (§7.1/§7.2): advance `watermark[domain]` to `lmid` (monotone max) and,
+     *  on a fresh session ahead of our issued mids, adopt `nextMid[domain]`. Shared verbatim by the
+     *  per-channel lmid system query ({@link foldLmidOps}) and the daemon-carried room-ledger rows
+     *  ({@link foldSystemFrames} — one core so the two paths cannot drift). */
+    foldConfirm(domain, lmid) {
+        if (!Number.isFinite(lmid))
+            return;
+        const highestIssued = (this.nextMid.get(domain) ?? 1) - 1;
+        if (lmid > highestIssued) {
+            // Only in-flight mutations of THIS domain can contradict its watermark (§7.1: the counters
+            // are independent — a room-domain mutation pending while the daemon's historical lmid
+            // snapshot arrives is a normal fresh-session interleaving, not a second writer). An
+            // unflushed fold (`mid == null`) has issued nothing yet either way: it cannot explain a
+            // confirmed-ahead lmid, and its eventual flush deals from the adopted counter below.
+            if (this.pendingMutations.some((p) => p.domain === domain && p.mid !== null)) {
+                // The server confirmed a mid we never issued while we have mutations in
+                // flight on this domain — two writers on one clientID or corrupted state. Unrecoverable.
+                throw new Error(`optimistic backend: confirmed lmid ${lmid} is ahead of issued mids (${highestIssued})`);
+            }
+            // A fresh session over a clientID with history: adopt the server's high-water
+            // mark so our next mid continues the sequence instead of colliding below it.
+            this.nextMid.set(domain, lmid + 1);
+        }
+        this.watermark.set(domain, Math.max(this.watermark.get(domain) ?? 0, lmid));
+    }
+    // --- the §4 lifecycle system-stream folds (Slice I-iii) --------------------------------
+    /** Fold one release's SYSTEM frames in a FIXED category order — the order is STRUCTURAL (one
+     *  function, categories in sequence), because it is the client half of THE NAMED INVARIANT
+     *  (§3.3's shipped note; documented above {@link handleMutationOutcome}): **never retire a
+     *  room-domain entry off a daemon-carried lmid without outcome resolution.**
+     *
+     *    1. **outcome rows** (`_rindle_room_mutation_outcomes`) — each row for OUR clientID is
+     *       synthesized into a {@link MutationOutcomeFrame} and routed through
+     *       {@link handleMutationOutcome}, the SAME H-v state machine the room socket's frames use
+     *       (one verdict path: frames and rows cannot drift). A deopt flips its pending entry to
+     *       the daemon IN PLACE (keep-seq, deal-and-send-now); a rejection surfaces + stays for the
+     *       ordinary burnt-mid retire; a duplicate (frame already seen, or the row re-delivered) is
+     *       absorbed by the processed set — which doubles as the resolved-verdict memory across
+     *       releases (per-domain FIFO, {@link MAX_PROCESSED_OUTCOMES_PER_DOMAIN}, mirroring the
+     *       shell's recorded-outcome cap).
+     *    2. **room-ledger rows** (`_rindle_room_client_mutations`) — the FIRST daemon-carried
+     *       room-lmid path: OUR row's `last_mutation_id` folds into `watermark[room:<doc>]` via
+     *       {@link foldConfirm}. Because step 1 ALREADY resolved every non-applied verdict this
+     *       release carries (and earlier releases' verdicts were resolved at their own release),
+     *       the confirm-drop that follows in {@link applyRelease} retires only entries whose
+     *       outcome is resolution-by-absence — which I-ii's co-commit atomicity defines as APPLIED
+     *       (a room flush co-commits the ledger row and every non-applied mid's outcome row in ONE
+     *       daemon transaction, so a covering lmid without a row IS the applied verdict).
+     *       Processing this category before step 1 is the violation, in two proven directions
+     *       (each run break→fail→revert against `test/system_streams.test.ts`): (a) the ledger's
+     *       fresh-session `nextMid` ADOPTION must not run before historical outcome rows are
+     *       judged — adopted-first, a previous session's retained deopt row passes the
+     *       "never-issued" guard and spuriously re-invokes a mutation that session already handled
+     *       (a double-apply); (b) the RETIRE must not precede resolution — it does not BECAUSE the
+     *       confirm-drop runs in {@link applyRelease}, strictly after this whole function. That
+     *       deferral is load-bearing: an "optimization" retiring inline with the watermark fold
+     *       retires a deopted entry as a silent success (the exact lost-write H-v exists to
+     *       prevent) and mis-attributes a rejected row's reason.
+     *    3. **watermark rows** (`_rindle_room_watermark`) — the §4.2 fence value, max-folded per
+     *       doc ({@link roomWatermarks}); I-v's ghost-drop consumer, no reaction here.
+     *    4. **scope-session rows** (`_rindle_scope_sessions`) — the §4.1 occupancy map
+     *       ({@link scopeSessions}); I-iv's doorbell consumer, no reaction here.
+     *
+     *  Ordinary data ops fold AFTER all of these (the caller's main loop) — outcome/ledger state
+     *  must be in place before {@link applyRelease}'s confirm-drop + reconcile consume the release.
+     *  Every row is filtered against the retain's {@link SystemStreamSpec} scope/doc AND (for the
+     *  client-keyed tables) our own `clientID` — defense in depth: the server predicate may have
+     *  been minted doc-only (no `clientId` at lease time), so other clients' rows are expected and
+     *  must be ignored, and a row for a doc this retain was not minted for is never folded.
+     *
+     *  Returns the scopes category 4 touched (snapshot or ops) — the I-iv doorbell events' input;
+     *  `null` when none (every non-lifecycle release). The events themselves fire from
+     *  `onGateProgress` AFTER the release applies, never from inside the fold. */
+    foldSystemFrames(frames) {
+        if (frames.length === 0)
+            return null;
+        const byTable = (table) => frames.flatMap((frame) => {
+            const spec = this.systemQids.get(frame.qid);
+            return spec !== undefined && spec.table === table ? [{ spec, frame }] : [];
+        });
+        // (1) outcome rows → the H-v machine, BEFORE any ledger fold (the named invariant).
+        for (const { spec, frame } of byTable(ROOM_MUTATION_OUTCOMES_TABLE)) {
+            for (const op of frame.ops) {
+                const cells = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
+                if (!cells)
+                    continue; // a remove is retention pruning (mid ≤ lmid − 512), never a verdict
+                const row = decodeOutcomeRow(cells);
+                if (!row || row.clientId !== this.clientID)
+                    continue;
+                if (spec.doc !== undefined && row.doc !== spec.doc)
+                    continue;
+                const frameShape = {
+                    mid: row.mid,
+                    kind: row.kind,
+                    ...(row.reason !== undefined ? { reason: row.reason } : {}),
+                    ...(row.name !== undefined ? { name: row.name } : {}),
+                    ...(row.args !== undefined ? { args: row.args } : {}),
+                };
+                // Release-time invocation is sound here where out-of-band was REQUIRED for the socket
+                // frames (`attachGate`): the socket frame races a buffered lmid ack it must beat, so it
+                // may not wait behind the gate — a ROW cannot race its own release (it and the covering
+                // ledger row co-committed at one cv and fold in THIS function's fixed order). The
+                // machine's steps need nothing from an open release: the flip/reject only move pending
+                // bookkeeping + ship an envelope, and the not-found re-invoke arm runs a fresh prediction
+                // — legal before `applyRelease` opens the reconcile cycle, identical to an app invoke
+                // racing the release.
+                this.handleMutationOutcome(roomDomainKey(row.doc), frameShape);
+            }
+        }
+        // (2) room-ledger rows → the daemon-carried per-domain confirm (outcomes above resolved first).
+        for (const { spec, frame } of byTable(ROOM_CLIENT_MUTATIONS_TABLE)) {
+            for (const op of frame.ops) {
+                const cells = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
+                if (!cells)
+                    continue; // a ledger remove confirms nothing (mirrors foldLmidOps)
+                const [doc, clientId, lmid] = cells;
+                if (typeof doc !== "string" || clientId !== this.clientID)
+                    continue;
+                if (spec.doc !== undefined && doc !== spec.doc)
+                    continue;
+                this.foldConfirm(roomDomainKey(doc), Number(lmid));
+            }
+        }
+        // (3) watermark rows → the monotone §4.2 fence value per doc.
+        for (const { spec, frame } of byTable(ROOM_WATERMARK_TABLE)) {
+            for (const op of frame.ops) {
+                const cells = op.op === "add" ? op.row : op.op === "edit" ? op.new : undefined;
+                if (!cells)
+                    continue; // the fence is monotone — a remove never regresses it
+                const [doc, flushSeq] = cells;
+                const seq = Number(flushSeq);
+                if (typeof doc !== "string" || !Number.isFinite(seq))
+                    continue;
+                if (spec.doc !== undefined && doc !== spec.doc)
+                    continue;
+                this.roomWatermarks.set(doc, Math.max(this.roomWatermarks.get(doc) ?? 0, seq));
+            }
+        }
+        // (4) scope-session rows → the §4.1 occupancy map (a snapshot REPLACES the scope's map — an
+        // authoritative re-hydrate must drop sessions that aged out while the stream was down; a
+        // batch folds add/edit/remove incrementally). Touched scopes are collected for the I-iv
+        // doorbell events (a snapshot touches its minted scope even with zero ops — an emptied-out
+        // scope is a legitimate 1→0 observation for the transition tracker).
+        let touchedScopes = null;
+        const touch = (scope) => {
+            (touchedScopes ??= new Set()).add(scope);
+        };
+        for (const { spec, frame } of byTable(SCOPE_SESSIONS_TABLE)) {
+            if (frame.kind === "snapshot" && spec.scope !== undefined) {
+                this.scopeSessions.set(spec.scope, new Map());
+                touch(spec.scope);
+            }
+            for (const op of frame.ops) {
+                // A remove's identity rides its (full) removed row; add/edit carry the post-image.
+                const cells = op.op === "edit" ? op.new : op.row;
+                const [scope, clientId, expiresAt] = cells;
+                if (typeof scope !== "string" || typeof clientId !== "string")
+                    continue;
+                if (spec.scope !== undefined && scope !== spec.scope)
+                    continue;
+                let sessions = this.scopeSessions.get(scope);
+                if (!sessions)
+                    this.scopeSessions.set(scope, (sessions = new Map()));
+                if (op.op === "remove") {
+                    sessions.delete(clientId);
                 }
-                // A fresh session over a clientID with history: adopt the server's high-water
-                // mark so our next mid continues the sequence instead of colliding below it.
-                this.nextMid = lmid + 1;
+                else {
+                    const exp = Number(expiresAt);
+                    if (Number.isFinite(exp))
+                        sessions.set(clientId, exp);
+                }
+                touch(scope);
             }
-            this.confirmedLmid = Math.max(this.confirmedLmid, lmid);
         }
+        return touchedScopes;
+    }
+    /** The I-iv occupancy count — THE one rule (§4.1/D7): unexpired (`expires_at >` the fold
+     *  clock's now) sessions under `scope` from OTHER clientIDs. Shared by the doorbell events
+     *  ({@link onGateProgress}) and the client's registration-time check (a doorbell that folded
+     *  BEFORE a candidate registered must still be able to trigger it) so the two can never
+     *  disagree. Own-clientID rows never count — a solo client cannot ring its own bell — and
+     *  expiry is judged on the injectable {@link FoldClock} (deterministic in a virtual-clock
+     *  harness, the folded-oracle discipline). */
+    otherScopeSessions(scope) {
+        const sessions = this.scopeSessions.get(scope);
+        if (!sessions)
+            return 0;
+        const now = this.clock.now();
+        let n = 0;
+        for (const [clientId, expiresAt] of sessions) {
+            if (clientId !== this.clientID && expiresAt > now)
+                n++;
+        }
+        return n;
+    }
+    /** Register the I-iv doorbell event sink — see {@link ScopeSessionsEvent}. One handler (a later
+     *  registration replaces it, the {@link onLocalWrite} convention); client.ts is the consumer. */
+    onScopeSessions(handler) {
+        this.scopeSessionsHandler = handler;
     }
     /** One §1.3 reconcile cycle: rewind the optimistic layer and fold the coherent SERVER
      *  delta into BOTH head AND the `sync` baseline (`serverBatchBegin`), re-invoke every
@@ -819,37 +2011,56 @@ export class OptimisticBackend {
      *  deliver the coalesced result (`serverBatchEnd`). This is the engine's only sync-moving
      *  boundary — `onProgress` releases and `unregisterQuery`'s GC both go through here so head
      *  and sync never diverge (the §1.2 invariant; CRIT#2). */
-    runReconcileCycle(serverDeltas) {
+    runReconcileCycle(_sourceKey, serverDeltas) {
+        // `_sourceKey` names the authority these `deltas` confirm — `"daemon"` on the live daemon
+        // path (and the GC path), a `room:doc:X` string on a room release, whose deltas already carry
+        // the room's ENGINE table names (the gate's rename/filter). Kept for call-site readability
+        // and tracing only: the engine itself is source-agnostic (302: one authority per table) — its
+        // rewind covers EVERY tracked table and every pending mutation re-invokes below regardless of
+        // which channel released, so NOTHING in this cycle may branch on it.
         this.local.serverBatchBegin(serverDeltas.map(toServerOp));
-        // The rewind cleared every optimistic write — incl. prior `__agg` edits — so head is now
-        // the server baseline. Rebuild the optimistic agg delta from scratch off the re-invoked
-        // (confirm-filtered) pending set, so a just-confirmed mutation's delta vanishes exactly as
-        // its server count is absorbed (§5 watermark — no double count).
+        // The rewind covers EVERY tracked table (302: the engine is source-agnostic — there is no
+        // per-source rewind) — including the `__agg_*` head rows — whichever channel released. So the
+        // optimistic agg delta rebuilds on EVERY cycle, room or daemon: reset here, re-observe from
+        // the re-invoked pending set below, re-apply onto the rewound heads at the end. Gating any of
+        // the three on a daemon-only cycle (the pre-302 per-source-rewind contract) would let a room
+        // release wipe the optimistic `__agg` edits and skip the rebuild — every count() view snaps
+        // back to the server base until the next daemon release. The delta stays sound across
+        // domains: `reconcileAggHead` recomputes each head as the absolute `server_base ⊕ delta`,
+        // and the server base (`this.sync`) only moves on daemon releases.
         this.overlay.reset();
-        // Re-invoke in WIRE order: assigned mids ascending, then unflushed folds (`mid == null`) last
-        // by creation order — the deterministic slot of FOLDED-MUTATIONS-DESIGN §4.1. A read-dependent
-        // mutator must replay against the same base the server computed from, which is mid order; with
-        // deferred fold mids, mid order ≠ creation order, so we sort rather than trust array order. The
-        // comparator is explicit (NOT `(mid ?? ∞) - (mid ?? ∞)`, which is `∞ - ∞ = NaN` for two unflushed
-        // folds — a NaN comparator silently corrupts V8's sort): assigned-before-unflushed, mids
-        // ascending, and STABLE for two unflushed folds so they keep creation order across cycles.
+        // Sort ALL pending into SEND order (the client-global `seq` ascending, then unflushed folds
+        // last by creation order — the deterministic §4.1 slot; the comparator is explicit, NOT
+        // `(seq ?? ∞) - (seq ?? ∞)` which is `∞ - ∞ = NaN` and corrupts V8's sort). The key MUST be
+        // `seq`, never `mid`: mids are per-domain (§7.1) so mids from different domains are
+        // incomparable — a mid-sort would replay a room mid 1 before a daemon mid 5 that was sent
+        // FIRST, letting a read-dependent mutator re-predict from a base it never saw (confirmation
+        // order is per-domain; replay order is client-global). EVERY entry re-invokes — the engine's
+        // rewind covers every tracked table (302: there is no per-source rewind), so every entry's
+        // staged writes were just un-applied, whichever channel released. Single-domain: seq order ==
+        // mid order (except H-v deopt re-enqueues, which keep their ORIGINAL seq under a later daemon
+        // mid — deliberately, so this very sort replays them at their original overlay position).
         const order = [...this.pendingMutations].sort((a, b) => {
-            if (a.mid === null && b.mid === null)
+            if (a.seq === null && b.seq === null)
                 return 0; // both unflushed → stable creation order
-            if (a.mid === null)
-                return 1; // an unflushed fold sorts after every assigned mid
-            if (b.mid === null)
+            if (a.seq === null)
+                return 1; // an unflushed fold sorts after every dealt seq
+            if (b.seq === null)
                 return -1;
-            return a.mid - b.mid;
+            return a.seq - b.seq;
         });
         const dropped = new Set();
         try {
             for (const p of order) {
-                const touched = new Set();
+                // NO `readLog` here — recording is armed only on the initial `invoke` (§3.2 #2 note on
+                // `PendingMutation.reads`); a re-invocation's write-set still needs fresh capture (below).
+                // The staging map follows the entry's CURRENT domain — a deopt-flipped or re-routed entry
+                // re-stages onto its new domain's tables here.
+                const writes = new Map();
                 const ops = [];
                 try {
                     this.local.writeWith((tx) => {
-                        this.runMutator(this.registry[p.name], trackingTx(tx, touched, this.specs, this.localTables, this.opCollector(ops)), p.args);
+                        this.runMutator(this.registry[p.name], trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, undefined, this.stagingMap(p.domain)), p.args);
                     });
                 }
                 catch {
@@ -867,47 +2078,54 @@ export class OptimisticBackend {
                     this.overlay.observe(op);
                 // The pending footprint is the UNION across invocations: a re-run that no-ops (touched =
                 // {}) must NOT shrink it, else a still-pending mutation reports not-pending and its
-                // pending-axis clear fires early (§7.2).
-                for (const t of touched)
+                // pending-axis clear fires early (§7.2). `writes` mirrors this: merge, never replace.
+                for (const t of writes.keys())
                     p.touched.add(t);
+                mergeWriteSet(p.writes, writes);
             }
             // Preserve creation order in the live array (the unflushed-fold sort tiebreak depends on it).
             if (dropped.size)
                 this.pendingMutations = this.pendingMutations.filter((p) => !dropped.has(p));
             // Re-apply the optimistic agg delta onto the (rewound) `__agg` head rows — INSIDE the open
             // cycle, so the writes buffer and coalesce into the one per-query delivery `serverBatchEnd`
-            // makes (and never escape as a separate batch).
+            // makes (and never escape as a separate batch). Every cycle (see the reset above).
             this.reconcileAggHead();
         }
         finally {
             this.local.serverBatchEnd(); // ALWAYS close the cycle — ONE delivery per affected query.
         }
     }
-    /** The daemon restarted (a new boot id): it lost all materialization + `cv` state and its `cv`
-     *  sequence reset, so previously-released `cv`s no longer bound the new stream. The source has
-     *  already re-subscribed every query (reconnect → resync); drop the buffer and the `cv`
-     *  watermark so the fresh, low-`cv` snapshots are RELEASED instead of dropped as stale
-     *  (`onNormalized`/`onProgress` gate on `appliedCv`). Pending optimistic mutations stay put —
-     *  they re-apply on the next reconcile, and the lmid system query's fresh snapshot restores the
-     *  confirmation watermark. */
-    resetForRestart() {
-        this.buffer = [];
-        this.appliedCv = 0;
-    }
-    /** The §8.5 escape: the buffer outgrew its cap (a pinned `cvMin` under churn). Drop
-     *  everything buffered and re-register every query on the source — the fresh
-     *  snapshots arrive as ordinary frames and the next release re-hydrates via the
-     *  footprint diff (the §5.3 path); still-pending optimism re-applies in that cycle. */
-    overflow() {
-        this.buffer = [];
+    /** ONE channel's authority restarted (a new boot id): it lost all materialization + `cv` state
+     *  and its `cv` sequence reset, so previously-released `cv`s no longer bound the new stream. The
+     *  source has already re-subscribed every query (reconnect → resync); drop THIS gate's buffer
+     *  and `cv` watermark so the fresh, low-`cv` snapshots are RELEASED instead of dropped as stale
+     *  (`onFrame`/`computeRelease` gate on `appliedCv`). The OTHER gates are untouched — an
+     *  authority restart is per-channel (§5.1). Pending optimistic mutations stay put — they
+     *  re-apply on the next reconcile, and the channel's lmid system query's fresh snapshot restores
+     *  its domain's confirmation watermark. */
+    resetGate(gate) {
+        gate.buffer = [];
+        gate.appliedCv = 0;
+    }
+    /** The §8.5 escape: ONE gate's buffer outgrew its cap (a pinned `cvMin` under churn on that
+     *  channel). Drop everything it buffered and re-register every query on that source — the fresh
+     *  snapshots arrive as ordinary frames and the next release re-hydrates via the footprint diff
+     *  (the §5.3 path); still-pending optimism re-applies in that cycle. The other gates' buffers
+     *  and subscriptions are untouched. */
+    overflow(gate) {
+        gate.buffer = [];
         for (const sub of this.remoteSubs.values()) {
-            this.source.unregisterQuery(sub.sourceQid);
-            this.source.registerQuery(sub.sourceQid, sub.remote);
+            // Re-register only the subs THIS channel owns ({@link RemoteSub.channel} — the one source
+            // of truth, G-iii): resubscribing another channel's sub here would fork its stream.
+            if (sub.channel !== gate.key)
+                continue;
+            gate.source.unregisterQuery(sub.sourceQid);
+            gate.source.registerQuery(sub.sourceQid, sub.remote);
         }
         // The lmid system query's buffered frames were dropped too — re-subscribe it so a
         // fresh snapshot restores the confirmation watermark.
-        this.source.unregisterQuery(LMID_QID);
-        this.source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
+        gate.source.unregisterQuery(LMID_QID);
+        gate.source.registerQuery(LMID_QID, { name: LMID_QUERY_NAME, args: {} });
     }
     setResultType(qid, rt) {
         if (this.resultTypes.get(qid) === rt)
@@ -921,8 +2139,10 @@ export class OptimisticBackend {
         this.setResultType(qid, this.hydrated.has(qid) ? "complete" : "unknown");
     }
     /** A remote sub's first snapshot landed: mark it (and every local view it feeds) hydrated, then
-     *  lift those views out of `unknown` (loading). Idempotent — a re-hydrate snapshot re-marks
-     *  harmlessly; a source qid with no sub (the lmid system query) is a no-op. */
+     *  lift those views out of `unknown` (loading). A ROOM sub's hydration additionally queues the
+     *  302 §4.1 swap-in — performed at the applyRelease TAIL ({@link processSwapIns}), once the
+     *  reconcile has folded this snapshot into the room tables. Idempotent — a re-hydrate snapshot
+     *  re-marks harmlessly; a source qid with no sub (the lmid system query) is a no-op. */
     markSubHydrated(sourceQid) {
         const key = this.sourceToRemote.get(sourceQid);
         if (!key)
@@ -931,37 +2151,71 @@ export class OptimisticBackend {
         if (!sub || sub.hydrated)
             return;
         sub.hydrated = true;
+        if (sub.channel !== "daemon" && !this.systemQids.has(sub.sourceQid))
+            this.pendingSwapIns.add(sub);
         for (const localQid of sub.localQids.keys()) {
             this.hydrated.add(localQid);
             this.recomputeResultType(localQid);
         }
     }
-    retainRemote(retainQid, remote, localQueryId = retainQid) {
+    /** `channel` (G-iii registration-time routing): the gate the sub registers on — the qid's
+     *  ownership is fixed HERE, at retain time (no lazy claim; `onFrame` only asserts it). Default
+     *  `"daemon"`, so every channel-less caller is byte-identical to before. */
+    retainRemote(retainQid, remote, localQueryId = retainQid, channel = "daemon") {
+        const gate = this.requireGate(channel); // throw loudly BEFORE any sub state moves
         const key = remoteKey(remote);
         let sub = this.remoteSubs.get(key);
         let isNew = false;
         if (!sub) {
-            sub = { sourceQid: retainQid, remote, refCount: 0, localQids: new Map(), hydrated: false };
+            sub = { sourceQid: retainQid, remote, refCount: 0, localQids: new Map(), hydrated: false, channel };
             this.remoteSubs.set(key, sub);
             this.sourceToRemote.set(sub.sourceQid, key);
             isNew = true;
         }
+        else if (sub.channel !== channel) {
+            // A (name,args) sub lives on ONE channel — a second retain naming another is a wiring bug
+            // (it would split the query's frames across two cv timelines). Fail loudly.
+            throw new Error(`optimistic backend: query "${remote.name}" is already retained on channel ${JSON.stringify(sub.channel)} — cannot retain it on ${JSON.stringify(channel)}`);
+        }
         sub.refCount++;
         if (localQueryId !== undefined) {
             sub.localQids.set(localQueryId, (sub.localQids.get(localQueryId) ?? 0) + 1);
             // A late-joiner to an already-hydrated sub is immediately hydrated; otherwise this view now
             // awaits the sub's first snapshot (so a split-path local view registered `complete` flips to
             // `unknown` here). Then recompute its lifecycle.
-            if (sub.hydrated)
+            if (sub.hydrated) {
                 this.hydrated.add(localQueryId);
-            else
+                // 302 §4.1 LATE JOIN: a ROOM sub's one-shot swap queue ({@link markSubHydrated}) fired at
+                // its first released snapshot — long gone by now — so a view attaching afterwards must
+                // swap onto the room's namespaced tables HERE, or its engine query stays registered on
+                // the plain daemon tables the room channel never feeds (empty/stale, reported complete,
+                // diverging from its already-swapped siblings forever). The room tables already hold the
+                // released state (hydrated ⇒ folded), so swapping immediately is the ordinary
+                // after-the-data order; processSwapIns skips already-swapped siblings, and
+                // pendingSwapIns is empty outside a release, so exactly this sub's un-swapped views move.
+                if (sub.channel !== "daemon" && !this.systemQids.has(sub.sourceQid)) {
+                    this.pendingSwapIns.add(sub);
+                    this.processSwapIns();
+                }
+                // FORCE the notify past setResultType's dedup: the labeled split registers the local
+                // half `complete`, then flips the STORE view to `unknown` for the lease window WITHOUT
+                // touching our record — so a complete→complete recompute here would swallow the event
+                // and strand the late-joining view `unknown` forever. Redundant notifies are idempotent
+                // Store-side; a swallowed transition is not recoverable.
+                this.resultTypes.set(localQueryId, "complete");
+                this.resultTypeHandler(localQueryId, "complete");
+            }
+            else {
                 this.hydrated.delete(localQueryId);
-            this.recomputeResultType(localQueryId);
+                this.recomputeResultType(localQueryId);
+            }
         }
         this.localToRemote.set(retainQid, key);
         this.remoteRetainToLocal.set(retainQid, localQueryId);
+        // Register on the CHANNEL's source (G-iii): the qid's frames will arrive — and buffer, release,
+        // and overflow — on that channel's own §5.1 gate.
         if (isNew)
-            this.source.registerQuery(sub.sourceQid, remote);
+            gate.source.registerQuery(sub.sourceQid, remote);
     }
     releaseRemote(retainQid) {
         const key = this.localToRemote.get(retainQid);
@@ -983,7 +2237,10 @@ export class OptimisticBackend {
         }
         if (sub.refCount > 0)
             return undefined;
-        this.source.unregisterQuery(sub.sourceQid);
+        // Unregister from the SAME gate's source the retain registered on. Since I-v a gate CAN be
+        // removed ({@link disconnectSource}) — but never with a live sub on it ({@link
+        // demoteRoomSource} validates loudly), so the daemon fallback is purely defensive.
+        (this.gates.get(sub.channel) ?? this.daemonGate).source.unregisterQuery(sub.sourceQid);
         this.sourceToRemote.delete(sub.sourceQid);
         this.remoteSubs.delete(key);
         return sub.sourceQid;
@@ -1061,18 +2318,91 @@ function colIndexFromSchema(schema) {
     }
     return out;
 }
-/** Wrap the raw wasm txn as the client `MutationTx`, recording the touched tables (the client
- *  knows its own footprint — what the pending axis derives from, §7.2). The keyed methods validate
- *  column names eagerly: a typo'd table or column throws with the valid names listed, at the moment
- *  the mutator runs.
+/** Merge a fresh invocation's write-set into a `PendingMutation`'s accumulated one (§3.2 #1, rebase
+ *  re-invocation): each pk's value is OVERWRITTEN with the newest image (a later invocation ran
+ *  against the base the rebase just replaced, so its view supersedes the earlier one), but a key
+ *  present only in `dest` is left alone — the same union-never-shrink rule `touched` already
+ *  follows (§7.2: "a re-run that no-ops must NOT shrink it"). */
+function mergeWriteSet(dest, src) {
+    for (const [table, byPk] of src) {
+        let d = dest.get(table);
+        if (!d)
+            dest.set(table, (d = new Map()));
+        for (const [pkKey, rec] of byPk)
+            d.set(pkKey, rec);
+    }
+}
+// --- the 302 room-table helpers -------------------------------------------------------
+/** The namespaced ENGINE table backing wire `table` for room `sourceKey` (302 §2: `room_deck` ≠
+ *  `deck` — one authority per table). `@` appears in no schema table name — ENFORCED by
+ *  `createSchema`/`extendSchema`'s addTableMeta ban (packages/client/src/schema.ts), so the name
+ *  cannot collide with a real table. */
+export function roomEngineTable(table, sourceKey) {
+    return `${table}@${sourceKey}`;
+}
+/** Rename a room gate's released deltas into the room's namespaced tables, DROPPING deltas for
+ *  wire tables outside the map (context / unknown — the daemon is their sole authority, 302 §6).
+ *  Identity (no copy) for a map-less gate — the daemon path is untouched. */
+function mapGateDeltas(gate, muts) {
+    const map = gate.tableMap;
+    if (map === undefined)
+        return muts;
+    const out = [];
+    for (const m of muts) {
+        const engineTable = map.get(m.table);
+        if (engineTable === undefined)
+            continue;
+        out.push({ ...m, table: engineTable });
+    }
+    return out;
+}
+/** Rename every TABLE reference in a query AST through `map` (302 §2 point 3 — the room-homed
+ *  view's rewrite): the root `table`, every `related` subquery, every `correlatedSubquery`
+ *  (EXISTS) condition — walking the KNOWN wire-AST shape, never a blind key scan: `start.row` is
+ *  keyed by COLUMN name (a schema column literally named `table` must keep its bound value), and
+ *  the same goes for any future column-keyed record. Tables absent from the map keep their name —
+ *  that is the client-side join across kinds (a room table joined to daemon-owned context,
+ *  201-style). Structural clone; the input AST is never mutated. */
+export function remapAstTables(ast, map) {
+    const walkCond = (c) => {
+        if (c.type === "and" || c.type === "or")
+            return { ...c, conditions: c.conditions.map(walkCond) };
+        if (c.type === "correlatedSubquery")
+            return { ...c, related: walkSub(c.related) };
+        return c; // "simple" — column refs and literals carry no table reference
+    };
+    const walkSub = (s) => ({ ...s, subquery: walk(s.subquery) });
+    const walk = (a) => ({
+        ...a,
+        table: map.get(a.table) ?? a.table,
+        ...(a.where !== undefined ? { where: walkCond(a.where) } : {}),
+        ...(a.having !== undefined ? { having: walkCond(a.having) } : {}),
+        ...(a.related !== undefined ? { related: a.related.map(walkSub) } : {}),
+    });
+    return walk(ast);
+}
+/** Wrap the raw wasm txn as the client `MutationTx`, capturing a pk-granular write-set as it
+ *  applies (`writes`, a {@link WriteSet} — table → pk-key → last-write-wins image, §3.2 #1);
+ *  `touched` (the pending axis's table-granular Set, §7.2) is derived by the CALLER as
+ *  `new Set(writes.keys())`, never populated here. The keyed methods validate column names eagerly:
+ *  a typo'd table or column throws with the valid names listed, at the moment the mutator runs.
+ *
+ *  With `trapReads` (the FOLDED path, §5), the PUBLIC reads `tx.get`/`tx.row`/`tx.query` throw
+ *  `FoldReadError` — a folded mutator that reads state to compute its write is non-absorbing and
+ *  refused. The keyed writers (`update`/`upsert`/`insertIgnore`/`delete`) still read internally to
+ *  preserve unspecified columns / check pre-existence; that is fold-legal (the trap wraps only the
+ *  returned object's `get`/`row`/`query` surface, never the writers' internal probe) — unchanged
+ *  by H-ii, which records those probes but arms recording only where the trap never is.
  *
- *  With `trapReads` (the FOLDED path, §5), the PUBLIC reads `tx.get`/`tx.row` throw `FoldReadError`
- *  — a folded mutator that reads state to compute its write is non-absorbing and refused. The keyed
- *  writers (`update`/`upsert`/`delete`) still read internally to preserve unspecified columns; that
- *  is column-preservation, not value-derivation, so it stays allowed. */
+ *  With `readLog` (recording mode, RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §3.2 #2) — a SIBLING
+ *  of `trapReads`, the two never armed together by any call site — the PUBLIC `tx.get`/`tx.row`
+ *  push a `(table, pk, outcome, source?)` {@link ReadRecord} (per-read provenance via the
+ *  `provenance` probe, H-ii §3.2 #3), `tx.query` pushes its resolved AST, and (H-ii) the keyed
+ *  writers' pre-existence probes record through the same path. Pure capture: it changes no return
+ *  value, throws nothing, and is a no-op when `readLog` is omitted. */
 /** Apply one logical {@link MutationOp} (yielded by a shared generator mutator) onto the client's
  *  keyed {@link MutationTx} — the same methods a plain client mutator calls directly. Column
- *  validation, touched-table tracking, and op collection all happen inside those methods. */
+ *  validation, write-set capture, and op collection all happen inside those methods. */
 function applyOpToTx(tx, op) {
     switch (op.kind) {
         case "insert":
@@ -1087,13 +2417,22 @@ function applyOpToTx(tx, op) {
             return tx.delete(op.table, op.pk);
     }
 }
-function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
+function trackingTx(tx, writes, specs, localTables, onOp, trapReads = false, readLog, 
+/** The 302 staging map for a room-DECLARED mutation: wire table → the room's namespaced engine
+ *  table for the tables the room owns; identity for everything else. Every raw engine access —
+ *  reads and writes — goes through it, so a room mutator reads/writes the room's own state
+ *  (its optimistic effects land where the room-homed views look) while its envelope still
+ *  ships the wire names. Absent (or a non-owned table) ⇒ the plain table, verbatim. */
+stage) {
     const spec = (table) => {
         const s = specs[table];
         if (!s)
             throw new Error(`unknown table ${JSON.stringify(table)} — tables: ${Object.keys(specs).join(", ")}`);
         return s;
     };
+    /** The ENGINE table a wire-named access lands on (302 §2). Schema/column validation always
+     *  runs on the WIRE name (the namespaced twin shares the spec). */
+    const staged = (table) => stage?.get(table) ?? table;
     // M1 (`201-LOCAL-ONLY-TABLES-DESIGN.md` §6): a replayable mutator is a pure function of
     // (synced base + args) — it neither READS nor WRITES a local-only table. The server runs the
     // same mutator from `args` alone and cannot see local tables, so any dependence diverges the
@@ -1121,6 +2460,24 @@ function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
         }
     };
     const pkCells = (table, obj) => spec(table).primaryKey.map((i) => obj[spec(table).columns[i]]);
+    // pk from the POSITIONAL wire shape (raw cells in schema column order) — the counterpart of
+    // `pkCells` (which reads a KeyedRow) for the raw `add`/`remove`/`edit` writers below (§3.2 #1).
+    const pkFromCells = (table, cells) => spec(table).primaryKey.map((i) => cells[i]);
+    // Record (or overwrite) this pk's write for the invocation (§3.2 #1): last-write-wins WITHIN
+    // this invocation — an add-then-edit (or edit-then-edit) of the same pk collapses to its final
+    // image, matching the engine head's own semantics for that pk. The record is replaced with
+    // exactly the arguments given: the CALLERS (`edit`/`remove` below, consulting `prior`) decide
+    // the pre-image per the H-ii coalescing matrix on {@link WriteRecord}. Keyed by the STAGED
+    // (engine) table name, so the pending axis and the write-set match what the engine holds.
+    const recordWrite = (engineTable, pk, row, oldRow) => {
+        let byPk = writes.get(engineTable);
+        if (!byPk)
+            writes.set(engineTable, (byPk = new Map()));
+        const pkKey = stableJson(pk);
+        // Defensive copies: the wasm binding's returned arrays are not contractually immutable/unique,
+        // so a captured record must not alias a cell array the engine could later reuse or mutate.
+        byPk.set(pkKey, { table: engineTable, pk: [...pk], row: row ? [...row] : undefined, ...(oldRow ? { oldRow: [...oldRow] } : {}) });
+    };
     // A full insert row: each cell is `obj[c]`, or `null` for an omitted nullable column (design 206
     // §6.2); a `json` object is stringified for the engine (`toCell`). Non-nullable columns are
     // guaranteed present by `checkColumns(full)`.
@@ -1133,29 +2490,99 @@ function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
         spec(table).columns.forEach((c, i) => (out[c] = cells[i]));
         return out;
     };
-    // Internal read — used by the keyed writers below and the keyed `row` reader; never trapped (for
-    // the FOLD trap) but ALWAYS guarded against local reads (M1).
+    // The raw, UN-recorded read primitive behind `getImpl`/`rowImpl` — the M1 local guard + the txn
+    // read, nothing else. Slice B deliberately kept the keyed writers (`update`/`upsert`/
+    // `insertIgnore`/`delete`) on this, un-recorded ("recording is about the PUBLIC read entry
+    // points"). H-ii deliberately REVERSES that: the pre-existence probe each keyed writer BRANCHES
+    // on is genuine value-dependence the §3 routing proof must see — the concrete silent-drop shape
+    // is `update("cards", {id:5,…})` where the client's daemon slice has the row but the room's
+    // footprint lacks it: the room-side update no-ops, the commit "succeeds" with zero effects, the
+    // confirm retires the entry, and the user's edit silently vanishes. The proof can only refuse
+    // that route if the probe is on the record. So the keyed writers now probe through `getImpl`
+    // (recorded like any public read, §3.2 #3); the FOLD trap is unaffected — it wraps only the
+    // returned object's `get`/`row`/`query` surface, so keyed writers stay fold-legal and the
+    // trapped path (where `readLog` is never armed) records nothing, exactly as before.
     const rawGet = (table, pk) => {
         assertNotLocal(table, "read");
-        return tx.get(table, pk);
+        return tx.get(staged(table), pk);
+    };
+    // Push one {@link ReadRecord} when recording is armed (§3.2 #2/#3): outcome from `row`'s
+    // presence. Pure capture for inspection.
+    const recordRead = (table, pk, row) => {
+        if (!readLog)
+            return;
+        readLog.reads.push({
+            table,
+            pk: [...pk],
+            outcome: row === undefined ? "absent" : "present",
+        });
+    };
+    // The PUBLIC positional read (§3.2 #2) — and, since H-ii, the keyed writers' pre-existence
+    // probe (§3.2 #3, see the `rawGet` note): `rawGet` plus a `readLog` record when recording is
+    // armed. A no-op record when `readLog` is omitted — exactly `rawGet`'s behavior then.
+    const getImpl = (table, pk) => {
+        const result = rawGet(table, pk);
+        recordRead(table, pk, result);
+        return result;
     };
+    // The PUBLIC keyed read (§3.2 #2), the `row` counterpart of `getImpl`.
+    const rowImpl = (table, pk) => {
+        checkColumns(table, pk, false);
+        const pkc = pkCells(table, pk);
+        const cells = rawGet(table, pkc);
+        recordRead(table, pkc, cells);
+        return cells ? toKeyed(table, cells) : undefined;
+    };
+    // The pk's existing record from THIS invocation, if any — the coalescing-matrix input for
+    // `edit`/`remove` below (see {@link WriteRecord}). Keyed by the STAGED name like the records.
+    const prior = (table, pk) => writes.get(staged(table))?.get(stableJson(pk));
     const add = (table, row) => {
         assertNotLocal(table, "write");
-        touched.add(table);
+        const t = staged(table);
+        recordWrite(t, pkFromCells(table, row), row);
+        // ChildOps carry the WIRE name (unlike the write-set): the agg overlay's defs are keyed by
+        // the ORIGINAL AST's child tables (`collectAggDefs`), and the `__agg_*` heads it feeds are
+        // shared by plain and swapped views alike — a staged name would silently miss the dispatch
+        // and the optimistic count would lag every room-declared write until its echo.
         onOp?.({ table, kind: "add", row });
-        tx.add(table, row);
+        tx.add(t, row);
     };
     const remove = (table, row) => {
         assertNotLocal(table, "write");
-        touched.add(table);
-        onOp?.({ table, kind: "remove", row });
-        tx.remove(table, row);
+        const t = staged(table);
+        const pk = pkFromCells(table, row);
+        // The remove PRE-IMAGE (the H-ii matrix on {@link WriteRecord}): remove-after-edit/-remove
+        // keeps the ORIGINAL captured pre-image (the txn-entry base — the net effect is a remove of
+        // the row the external world last knew, never the edited transient). Otherwise (first touch,
+        // or remove-after-add) the truthful full-width row is the txn-visible one — `tx.get` read
+        // BEFORE the remove stages (read-your-writes: an add of this pk earlier in the SAME
+        // invocation shows through). Falls back to the caller's asserted `row` when the pk is not
+        // resident (a raw remove of an absent row) — a captured remove thus always carries a
+        // full-width pre-image.
+        const oldRow = prior(table, pk)?.oldRow ?? tx.get(t, pk) ?? row;
+        recordWrite(t, pk, undefined, oldRow);
+        onOp?.({ table, kind: "remove", row }); // wire name — see `add`
+        tx.remove(t, row);
     };
     const edit = (table, oldRow, newRow) => {
         assertNotLocal(table, "write");
-        touched.add(table);
-        onOp?.({ table, kind: "edit", row: newRow, old: oldRow });
-        tx.edit(table, oldRow, newRow);
+        const t = staged(table);
+        const pk = pkFromCells(table, newRow);
+        // The edit PRE-IMAGE (the H-ii matrix on {@link WriteRecord}). First touch: the txn-visible
+        // row read BEFORE staging, falling back to the caller's asserted `oldRow` when the pk is not
+        // resident (covers the pk-MOVING raw edit — the record is keyed by the NEW pk; the pre-image
+        // carries the OLD row). Edit-after-edit: keep the FIRST pre-image (the txn-entry base).
+        // Edit-after-add / edit-after-remove: the record collapses to a (re-)insert — NO pre-image
+        // (the pk did not pre-exist this invocation's base).
+        const p = prior(table, pk);
+        const pre = p === undefined
+            ? (tx.get(t, pk) ?? oldRow)
+            : p.row !== undefined && p.oldRow !== undefined
+                ? p.oldRow
+                : undefined;
+        recordWrite(t, pk, newRow, pre);
+        onOp?.({ table, kind: "edit", row: newRow, old: oldRow }); // wire name — see `add`
+        tx.edit(t, oldRow, newRow);
     };
     // The folded read trap (§5): a mutator that reads to compute its write is refused. `() => never`
     // is assignable to the wider read signatures (extra args ignored, `never` widens to the result).
@@ -1171,28 +2598,29 @@ function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
         const ast = q.ast();
         for (const t of collectTables(ast))
             assertNotLocal(t, "read");
-        return tx.query(ast);
+        readLog?.queries.push(ast);
+        // A room-declared mutator's one-shot query reads the room's own staged state for the tables
+        // the room owns (the same staging rule as the point reads above).
+        return tx.query(stage !== undefined && stage.size > 0 ? remapAstTables(ast, stage) : ast);
     };
     return {
-        get: trapReads ? trapped : rawGet,
+        get: trapReads ? trapped : getImpl,
         query: trapReads ? trapped : runQuery,
         add,
         remove,
         edit,
-        row: trapReads
-            ? trapped
-            : (table, pk) => {
-                checkColumns(table, pk, false);
-                const cells = rawGet(table, pkCells(table, pk));
-                return cells ? toKeyed(table, cells) : undefined;
-            },
+        row: trapReads ? trapped : rowImpl,
         insert: (table, row) => {
             checkColumns(table, row, true);
             add(table, toCells(table, row));
         },
+        // The keyed writers' pre-existence probes go through `getImpl` — RECORDED reads since H-ii
+        // (§3.2 #3): each writer BRANCHES on the probe, a value-dependence the routing proof must see
+        // (the silent-drop rationale on `rawGet` above). Fold-legal exactly as before (the trap wraps
+        // the public surface above, never these), and byte-identical when recording is off.
         update: (table, row) => {
             checkColumns(table, row, false);
-            const current = rawGet(table, pkCells(table, row));
+            const current = getImpl(table, pkCells(table, row));
             if (!current)
                 return; // rebase-friendly: the row may have vanished upstream
             const s = spec(table);
@@ -1203,7 +2631,7 @@ function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
         },
         upsert: (table, row) => {
             checkColumns(table, row, true);
-            const current = rawGet(table, pkCells(table, row));
+            const current = getImpl(table, pkCells(table, row));
             if (current)
                 edit(table, current, toCells(table, row));
             else
@@ -1211,12 +2639,12 @@ function trackingTx(tx, touched, specs, localTables, onOp, trapReads = false) {
         },
         insertIgnore: (table, row) => {
             checkColumns(table, row, true);
-            if (!rawGet(table, pkCells(table, row)))
+            if (!getImpl(table, pkCells(table, row)))
                 add(table, toCells(table, row));
         },
         delete: (table, pk) => {
             checkColumns(table, pk, false);
-            const current = rawGet(table, pkCells(table, pk));
+            const current = getImpl(table, pkCells(table, pk));
             if (!current)
                 return; // rebase-friendly no-op
             remove(table, current);