@rindle/optimistic 0.5.0 → 0.6.3

package/dist/backend.js

@@ -58,8 +58,8 @@ const REAL_CLOCK = {
     now: () => Date.now(),
 };
 /** The (shared, frozen-by-convention) empty map {@link OptimisticBackend.roomTablesFor} answers
- *  for a room with no promoted tables. */
-const EMPTY_ROUTING = new Map();
+ *  for a room with no registered tables. */
+const EMPTY_ROOM_TABLES = new Map();
 /** Per-domain retention cap for the processed-outcome set (H-v) — mirrors the shell's
  *  `MAX_RECORDED_OUTCOMES_PER_CLIENT`: the sender caps what it can re-answer at 512 per client,
  *  so remembering more than 512 processed mids per domain buys nothing. */
@@ -149,15 +149,23 @@ export class OptimisticBackend {
      *  an evicted mid would be re-processed — the same bounded-window trade the shell makes, and it
      *  takes 512 interleaving non-applied outcomes on one domain to open it. */
     outcomesProcessed = new Map();
-    /** THE routing table (H-iii §3): per connected room `sourceKey` → per promoted table → its
-     *  client-held {@link RoomTableRouting}. Written ONLY by {@link promoteRoomTable} (same breath
-     *  as the engine attach + {@link promotedTables}); read by {@link deriveDomain} and — via
-     *  {@link roomTablesFor} — the client's `__realtimeInspect` bookkeeping. */
-    roomRouting = new Map();
-    /** Q6 counters ({@link RoutingInspect}): successful derivations per room. */
-    routingDerived = new Map();
-    /** Q6 counters ({@link RoutingInspect}): derivation failures per {@link RoutingFailureReason}. */
-    routingReasons = new Map();
+    /** THE room-table registry (302 §2 — one source per table): per connected room `sourceKey`, the
+     *  wire-table → engine-table map for the tables that room OWNS (its writable scope). Written by
+     *  {@link registerRoomTables} (same breath as the engine registration); read by the gate's
+     *  release rename/filter, the mutator staging map, the view swap ({@link processSwapIns}), and
+     *  the client's `__realtimeInspect` bookkeeping. The record outlives a downgrade's disconnect —
+     *  the ghost's views still read the engine tables — and drops at {@link dropGhost} (or the last
+     *  clean release via {@link unregisterRoomTables}). */
+    roomTables = new Map();
+    /** Local view qids currently REGISTERED on a room's namespaced tables (302 §4 swap-in), →
+     *  their sourceKey. Set by {@link processSwapIns}; cleared by the swap-back ({@link dropGhost})
+     *  and view teardown. The original AST stays in {@link asts} throughout — the swap re-registers
+     *  only the ENGINE query. */
+    roomSwappedViews = new Map();
+    /** Room subs whose FIRST snapshot released in the current release — their views swap onto the
+     *  room tables at the release tail ({@link processSwapIns}), strictly AFTER the reconcile folded
+     *  the snapshot into those tables (swapping earlier would hydrate the view EMPTY, a flash). */
+    pendingSwapIns = new Set();
     /** The live fold entries, by fold key `${name}\0${identityJSON}` — at most one per key
      *  (FOLDED-MUTATIONS-DESIGN §8). Insertion order is creation order (the drain/flush tiebreak). */
     folds = new Map();
@@ -180,45 +188,6 @@ export class OptimisticBackend {
      *  scalars (`__inspect`) read it directly; its `sync` IS {@link sync} (the agg overlay and
      *  synthetic tables are daemon-tracked by design). */
     daemonGate;
-    /** Tables promoted to a MERGED multi-source engine (a room source attached). Written by the one
-     *  promotion seam ({@link promoteRoomTable}; the test-named {@link __addRoomSource} and Slice
-     *  G-v's lease-driven promotion from `RoomTableSpec[]` both flow through it). Read by the §7.3
-     *  hold-back trigger in
-     *  {@link applyRelease}: parking on a never-promoted (Collapsed) table is SKIPPED — inert anyway
-     *  today (`rewind_collapsed` never consults `held_back`), and a live hazard if the table later
-     *  promotes (a stale Collapsed-era entry turns overlay-first-visible and pins forever). Slice H's
-     *  prove-or-slow-path routing keeps the real scenario — a room-confirmed mutation writing a
-     *  Collapsed table — impossible; this gate covers the window until then. */
-    promotedTables = new Set();
-    /** The §301 pin registry ({@link EchoFencePin}): every parked §7.3 hold-back's delivery-fence
-     *  inputs, keyed `${table}\0${sourceKey}\0${pkKey}`. Written in the same breath as the
-     *  `holdBack`/`holdBackAbsent` park; read by {@link dropEchoFencePins} at the tail of every
-     *  release. Empty on every single-domain client — the drop pass is then a structural no-op. */
-    pins = new Map();
-    /** The §301 direction-A fence input: per room domain, the highest lmid the DAEMON-CARRIED
-     *  ledger rows have folded ({@link foldSystemFrames} step 2 — and ONLY that path: the room
-     *  socket's own lmid stream confirms long before the flush reaches the daemon, so it folds
-     *  into the shared {@link watermark} but never here, 301 §1.1). When this covers a pin's mid,
-     *  the same coherent release (or an earlier one) folded the flush data that carried it into
-     *  the daemon baseline — the fence. */
-    daemonCarriedLmid = new Map();
-    /** The §301 §2.4 boot rule's inputs: the daemon boot ids this client has OBSERVED, in order
-     *  (id → ordinal), plus the current one. Boot ids are opaque — ordering is the client's own
-     *  observation ({@link OptimisticSource.onBootId} on the daemon gate). Direction-B pins stamp
-     *  the current boot; a room advertising a LATER-observed boot proves absorption (its
-     *  re-snapshot came from a daemon state that durably includes the confirmed write). */
-    daemonBootOrdinals = new Map();
-    daemonBootId;
-    /** The per-read provenance probe `invoke` hands `trackingTx` when recording is armed (H-ii,
-     *  §3.2 #3): the engine's `provenanceOf` — the VISIBLE overlay-first winner for the row's pk,
-     *  read from LIVE pre-commit state (an open txn's staged writes are not consulted; H-i). Gated
-     *  on PER-TABLE {@link promotedTables} membership — the cheapest existing signal, and the
-     *  correct one: provenance is an ENGINE-merge question, not a channel question ({@link gates}
-     *  can hold a connected-but-unpromoted room feed, and the oracle harness promotes with no gate),
-     *  and a never-promoted (Collapsed) table is daemon-owned by construction. So a pure
-     *  single-domain app pays ZERO wasm calls per recorded read; the recorded `source` is then
-     *  `undefined`, which is also correct — everything is daemon-owned (see {@link ReadRecord}). */
-    readProvenance = (table, row) => this.promotedTables.has(table) ? this.local.provenanceOf(table, row) : undefined;
     // --- the §4 lifecycle SYSTEM-STREAM plane (Slice I-iii) --------------------------------
     /** System retains by source qid ({@link retainSystemQuery}): a subscription with NO store view
      *  and NO user-visible table — its frames buffer on its gate exactly like {@link LMID_QID}'s and
@@ -260,6 +229,12 @@ export class OptimisticBackend {
      *  only through outcome resolution; the ghost holds rather than inventing a timeout-retire).
      *  Default no-op. */
     downgradeStuckHandler = () => { };
+    /** The 302 §6.1 context-coverage surface ({@link onRoomContextJoin}) — fired at most once per
+     *  view ({@link contextJoinWarned}), at swap-in, when its AST references tables the room does
+     *  not own. Default no-op. */
+    roomContextJoinHandler = () => { };
+    /** Views the context-coverage event already fired for (once per view; cleared on teardown). */
+    contextJoinWarned = new Set();
     asts = new Map();
     /** Per query: the base tables its result can draw from (from the AST tree). */
     queryTables = new Map();
@@ -334,13 +309,6 @@ export class OptimisticBackend {
         source.onNormalized((qid, ev) => this.onFrame(gate, qid, ev));
         source.onProgress((frame) => this.onGateProgress(gate, frame));
         source.onRestart?.(() => this.resetGate(gate));
-        // §301 §2.4: the DAEMON channel's observed boot-id stream seeds the client-local boot
-        // ordinals the direction-B fence's boot rule compares against (boot ids are opaque; order is
-        // the client's own observation). Only the daemon gate's boots matter — a room's advertised
-        // `upstreamBoot` names a DAEMON boot, and room-channel incarnations are handled by
-        // `resetGate`. Optional: an in-process source never reports one.
-        if (key === "daemon")
-            source.onBootId?.((bootId) => this.observeDaemonBoot(bootId));
         // The deopt handshake's client half (H-v §3.3): the channel's `mutationOutcome` frames arrive
         // as `(domain = gate.key, frame)`. OUT-OF-BAND — the source dispatches on arrival and this
         // handler runs immediately, NEVER behind the gate's cv buffer: a deopt must migrate its entry
@@ -372,7 +340,52 @@ export class OptimisticBackend {
         if (this.gates.has(sourceKey)) {
             throw new Error(`optimistic backend: source ${sourceKey} is already connected`);
         }
-        this.attachGate(sourceKey, source, new NormalizedSync(this.pkCols, this.colCounts));
+        const gate = this.attachGate(sourceKey, source, new NormalizedSync(this.pkCols, this.colCounts));
+        // A re-upgrade of a doc whose tables are still registered (a ghost that never dropped, or a
+        // quick down/up bounce) adopts the surviving record as this incarnation's rename map.
+        const tables = this.roomTables.get(sourceKey);
+        if (tables !== undefined)
+            gate.tableMap = tables;
+        // …and CANCELS the pending swap-back: the room is the authority again, its views stay swapped,
+        // and a ghost left armed would fire against this LIVE gate when the old fence clears —
+        // un-swapping the views and unregistering the namespaced tables the gate's tableMap still
+        // renames deltas into (the next release would then throw from serverBatchBegin and poison the
+        // rebase state). A future downgrade arms a fresh ghost with its own fence.
+        this.ghosts.delete(sourceKey);
+    }
+    /** Register the tables room `sourceKey` OWNS (its writable scope — 302 §2): each wire table
+     *  gets its own namespaced ENGINE table (`{@link roomEngineTable}`), an ordinary tracked table
+     *  whose sole authority is the room channel. From here on the channel's released deltas rename
+     *  into these tables (wire tables outside the map are DROPPED — context stays daemon-owned,
+     *  302 §6), room-domain mutators stage onto them, and a room-homed view swaps onto them once
+     *  the room sub hydrates ({@link processSwapIns}). Idempotent per (sourceKey, table); a wire
+     *  table unknown to the schema is skipped (nothing to hold rows for). */
+    registerRoomTables(sourceKey, tables) {
+        if (sourceKey === "daemon") {
+            throw new Error("optimistic backend: the daemon is not a room — no namespaced tables");
+        }
+        let map = this.roomTables.get(sourceKey);
+        if (!map)
+            this.roomTables.set(sourceKey, (map = new Map()));
+        for (const table of tables) {
+            if (map.has(table))
+                continue;
+            const spec = this.specs[table];
+            if (spec === undefined || this.localTables.has(table))
+                continue;
+            const engineTable = roomEngineTable(table, sourceKey);
+            this.local.registerTable(engineTable, { columns: spec.columns, primaryKey: spec.primaryKey });
+            map.set(table, engineTable);
+        }
+        const gate = this.gates.get(sourceKey);
+        if (gate !== undefined)
+            gate.tableMap = map;
+    }
+    /** The wire-table → engine-table map for room `sourceKey`'s owned tables (empty when none) —
+     *  the client's idempotence check and `__realtimeInspect` read THIS record (one source of
+     *  truth; the client keeps no shadow copy). */
+    roomTablesFor(sourceKey) {
+        return this.roomTables.get(sourceKey) ?? EMPTY_ROOM_TABLES;
     }
     // --- the Backend seam ---------------------------------------------------------
     /** `channel` (G-iii registration-time routing) names the authority channel the remote sub
@@ -410,7 +423,7 @@ export class OptimisticBackend {
         // child is left a native reduce (L1) — `rewriteAggregates`/`ensureSyntheticTables` skip it.
         this.ensureSyntheticTables(qid, ast);
         // Local first (synchronous empty view), then the server stream hydrates it.
-        this.local.registerQuery(qid, rewriteAggregates(ast, (t) => this.localTables.has(t)));
+        this.local.registerQuery(qid, this.plainEngineAst(ast));
         if (remote) {
             // A remote query is `unknown` until its first server snapshot lands (hydration); retainRemote
             // attaches it to the sub and sets the lifecycle against the sub's hydration state.
@@ -484,6 +497,8 @@ export class OptimisticBackend {
             this.source.expectClientSchema?.([...this.clientTablesBase, ...this.synthetic.values()]);
     }
     unregisterQuery(qid) {
+        this.roomSwappedViews.delete(qid); // a swapped view's teardown forgets its room backing
+        this.contextJoinWarned.delete(qid); // …and its once-per-view coverage-warn latch
         const remoteQid = this.releaseRemote(qid);
         // GC: rows this remote footprint SOLELY referenced fall to refcount 0 → net removes. A qid
         // lives on ONE channel, so at most one gate's dropQuery is non-empty (dropQuery of an
@@ -493,7 +508,7 @@ export class OptimisticBackend {
             this.pendingRetargetGc.delete(remoteQid); // the sweep below covers a mid-retarget teardown
             for (const gate of this.gates.values()) {
                 gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
-                const gc = gate.sync.dropQuery(remoteQid);
+                const gc = mapGateDeltas(gate, gate.sync.dropQuery(remoteQid));
                 if (gc.length)
                     gcs.push([gate.key, gc]);
             }
@@ -545,7 +560,7 @@ export class OptimisticBackend {
         // Per-gate sweep, like `unregisterQuery`: at most one gate owned this qid's frames/rows.
         for (const gate of this.gates.values()) {
             gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
-            const gc = gate.sync.dropQuery(remoteQid);
+            const gc = mapGateDeltas(gate, gate.sync.dropQuery(remoteQid));
             if (gc.length)
                 this.runReconcileCycle(gate.key, gc);
         }
@@ -568,17 +583,15 @@ export class OptimisticBackend {
      *      precedent), flip `sub.channel`, re-arm `sub.hydrated` (the room's own snapshot is the
      *      cutover point), and register on the room source (its resolver presents the handed
      *      roomToken). The old gate's SYNC rows are deliberately NOT dropped: they keep the view's
-     *      rows visible through the window (merge: the daemon-tier holder). Local views keep their
-     *      `hydrated` membership — the view stays `complete` on its authoritative daemon rows.
-     *   2. AT THE ROOM'S FIRST RELEASED SNAPSHOT ({@link flushRetargetGc}): the room source now
-     *      holds the footprint rows (folded via `serverBatchBegin(sourceKey)` — value-equal rows
-     *      re-hydrate as a net-zero diff, RT §3.4 per channel), so the deferred
-     *      `dropQuery`+reconcile on the OLD gate flips each pk's winner daemon→room value-equal:
-     *      net-zero again. No emission carries a disappearance at any point.
+     *      plain tables populated through the window — the view still reads them until the swap.
+     *   2. AT THE ROOM'S FIRST RELEASED SNAPSHOT: the reconcile folds the snapshot into the room's
+     *      namespaced tables, the release tail SWAPS every local view onto them (302 §4.1,
+     *      {@link processSwapIns} — the accepted-flash boundary), and {@link flushRetargetGc}'s
+     *      deferred `dropQuery`+reconcile on the OLD gate then GCs the plain-table rows the sub
+     *      alone referenced — invisible to the swapped views.
      *
      *  Idempotent per target channel: a sub already on `sourceKey` returns immediately (the
-     *  double-doorbell / re-entrancy guard — one retarget per (query, sourceKey), mirroring
-     *  {@link promoteRoomTable}'s caller-side per-(sourceKey, table) idempotence). Validates before
+     *  double-doorbell / re-entrancy guard — one retarget per (query, sourceKey)). Validates before
      *  mutating: a throw here leaves the sub fully daemon-attached (the client's fail-open). */
     retargetRemoteQuery(remote, sourceKey) {
         const newGate = this.requireGate(sourceKey); // throw loudly BEFORE any sub state moves
@@ -621,41 +634,30 @@ export class OptimisticBackend {
             const oldGate = this.gates.get(oldGateKey);
             if (!oldGate)
                 continue;
-            const gc = oldGate.sync.dropQuery(sourceQid);
+            const gc = mapGateDeltas(oldGate, oldGate.sync.dropQuery(sourceQid));
             if (gc.length)
                 this.runReconcileCycle(oldGateKey, gc);
         }
     }
     // --- the §4.2 downgrade: demote → ghost → fence → drop (Slice I-v) ----------------------
-    /** The I-v downgrade orchestration primitive (§4.2/§7.4): retire room `sourceKey` behind the
-     *  watermark fence. The caller has ALREADY retargeted every live sub off the channel
-     *  ({@link retargetRemoteQuery} room→daemon — validated loudly below) and holds the fence from
-     *  the api-server's downgrade response (`finalFlushSeq` = the room's last COMMITTED flush seq;
-     *  `doc` keys the §4.2 watermark fold, {@link roomWatermarks}). Steps, in order:
+    /** The I-v downgrade orchestration primitive (§4.2/§7.4, re-expressed by 302 §4.2 as the
+     *  SWAP-BACK GATE): retire room `sourceKey` behind the watermark fence. The caller has ALREADY
+     *  retargeted every live sub off the channel ({@link retargetRemoteQuery} room→daemon —
+     *  validated loudly below) and holds the fence from the api-server's downgrade response
+     *  (`finalFlushSeq` = the room's last COMMITTED flush seq; `doc` keys the §4.2 watermark fold,
+     *  {@link roomWatermarks}). Steps, in order:
      *
-     *   1. **De-candidacy NOW**: the sourceKey's {@link roomRouting} entries are removed, so
-     *      {@link deriveDomain} stops proposing the room (zero candidates ⇒ `"daemon"`). Unsent
-     *      pending (`mid === null`) re-routes for free — a fold's flush re-derives from the live
-     *      candidate set (§7.5 rule 1). The engine's frozen scope still ANSWERS (`writableMatches`
-     *      / `provenanceOf` — freezing gates serving, not the scope definition); routing is
-     *      TS-gated here.
-     *   2. **Freeze** the WRITABLE promoted tables (`freezeSource`): the room slice becomes the
-     *      §4.2 ghost — wins-if-present in the merge (D4), so its rows (at-or-ahead of the daemon
-     *      until the flush echoes) stay visible while the slice accepts nothing. Context tables
-     *      (`writable: false`) are deliberately NOT frozen: the daemon is authoritative for them
-     *      LIVE (§5.2's context tier) and freezing would invert that, pinning a possibly-BEHIND
-     *      relayed copy over fresher daemon rows; unfrozen they keep exactly the live tiering.
-     *   3. **Disconnect** the channel ({@link disconnectSource}): handlers detached, gate + buffer
+     *   1. **Disconnect** the channel ({@link disconnectSource}): handlers detached, gate + buffer
      *      dropped. `nextMid`/`watermark`/processed-outcomes for the domain are KEPT FOREVER (§7.1:
      *      an assigned mid pins its domain; a later re-upgrade of the same doc continues the
      *      sequence — {@link connectSource} attaches a fresh gate and the lmid snapshot max-folds
      *      into the surviving watermark). Disconnecting BEFORE the daemon sub's first release is
      *      load-bearing: it makes {@link flushRetargetGc}'s deferred old-channel GC a no-op (gate
-     *      gone ⇒ record deleted, nothing dropped) — running that GC would rewind the room slice's
-     *      rows at daemon hydration, i.e. BEFORE the fence, surfacing a lagging follower's stale
-     *      images (the exact regression §4.2 exists to prevent). The ghost's rows leave only
-     *      through {@link dropGhost}'s `removeRoomSource`, value-equal under the fence.
-     *   4. **Ghost + first evaluation**: the record joins {@link ghosts} and is evaluated once
+     *      gone ⇒ record deleted, nothing dropped). The room's namespaced tables — and the views
+     *      swapped onto them — deliberately stay: frozen at the room's last state, they keep the
+     *      document visible while the falling-back follower may still lack the final flush.
+     *      Swapping back earlier would show its pre-flush images — the regression §4.2 prevents.
+     *   2. **Ghost + first evaluation**: the record joins {@link ghosts} and is evaluated once
      *      immediately — `finalFlushSeq === 0` (a never-flushed room) with no room-domain pending
      *      drops on the spot, the single-daemon first-frame case.
      *
@@ -667,8 +669,6 @@ export class OptimisticBackend {
         if (sourceKey === "daemon") {
             throw new Error("optimistic backend: the daemon source cannot be demoted");
         }
-        if (this.ghosts.has(sourceKey))
-            return; // idempotent — one ghost per source
         // Validate FIRST (nothing mutated yet): a live sub still on the channel would silently
         // starve once the gate detaches — the caller must retarget every sub off the room first.
         for (const sub of this.remoteSubs.values()) {
@@ -676,14 +676,22 @@ export class OptimisticBackend {
                 throw new Error(`optimistic backend: cannot demote ${JSON.stringify(sourceKey)} — query "${sub.remote.name}" is still retained on it (retarget it to the daemon first)`);
             }
         }
-        const routing = this.roomRouting.get(sourceKey);
-        const tables = routing ? [...routing.keys()] : [];
-        const writable = routing ? tables.filter((t) => routing.get(t).writable) : [];
-        this.roomRouting.delete(sourceKey); // (1) de-candidacy
-        for (const table of writable)
-            this.local.freezeSource(table, sourceKey); // (2) the ghost
-        this.disconnectSource(sourceKey); // (3) the channel
-        this.ghosts.set(sourceKey, { doc, finalFlushSeq, tables, stuckReported: false }); // (4)
+        // Idempotent per sourceKey (co-tenant queries sharing the room demote into the existing
+        // ghost) — but NEVER a bare early-return: each demote carries its own fence, so keep the
+        // NEWEST flush (monotone max — swapping back on an older fence would show pre-flush images),
+        // and disconnect defensively in case a gate re-attached since the ghost was armed (a
+        // down→up→down bounce; {@link connectSource} cancels the ghost on re-upgrade, so this arm
+        // normally finds no gate — but a stale gate left connected would let the next daemon release
+        // GC the room slice out from under the still-swapped views, the §4.2 regression).
+        const existing = this.ghosts.get(sourceKey);
+        if (existing) {
+            this.disconnectSource(sourceKey);
+            existing.finalFlushSeq = Math.max(existing.finalFlushSeq, finalFlushSeq);
+            this.evaluateGhosts();
+            return;
+        }
+        this.disconnectSource(sourceKey); // (1) the channel
+        this.ghosts.set(sourceKey, { doc, finalFlushSeq, stuckReported: false }); // (2)
         this.evaluateGhosts();
     }
     /** Detach one connected room channel (Slice I-v step 3): the source's handlers are replaced
@@ -717,6 +725,12 @@ export class OptimisticBackend {
     onDowngradeStuck(handler) {
         this.downgradeStuckHandler = handler;
     }
+    /** Register the 302 §6.1 context-coverage sink — see {@link RoomContextJoinEvent}. One handler
+     *  (a later registration replaces it, the {@link onScopeSessions} convention); client.ts maps
+     *  it onto the loud anomaly surface. */
+    onRoomContextJoin(handler) {
+        this.roomContextJoinHandler = handler;
+    }
     /** The I-v ghost-drop watcher (§4.2), run after every applied release ({@link applyRelease} —
      *  the seam where {@link roomWatermarks} has just folded and the confirm-drop has just run) and
      *  once at demote time. For each ghost: the fence must be satisfied
@@ -729,6 +743,11 @@ export class OptimisticBackend {
         if (this.ghosts.size === 0)
             return; // every non-downgrade release: structural no-op
         for (const [sourceKey, ghost] of [...this.ghosts]) {
+            // A LIVE gate means the doc re-upgraded — dropping now would dismantle the live room
+            // (un-swap its views, unregister the tables its tableMap renames into). connectSource
+            // cancels the ghost on re-upgrade, so this guard is purely defensive; hold, never drop.
+            if (this.gates.has(sourceKey))
+                continue;
             if ((this.roomWatermarks.get(ghost.doc) ?? 0) < ghost.finalFlushSeq)
                 continue; // fence holds
             const stuck = this.pendingMutations.filter((p) => p.domain === sourceKey && p.mid !== null);
@@ -739,52 +758,50 @@ export class OptimisticBackend {
                 }
                 continue; // hold — never a timeout-retire (§7.5 rule 2)
             }
-            this.dropGhost(sourceKey, ghost);
-        }
-    }
-    /** Drop one cleared ghost (§4.2 end state): detach every promoted table's room source (D2
-     *  stay-merged — `removeRoomSource` reconciles each held pk to daemon-or-vanish, value-equal
-     *  under the fence, so visually a no-op), release the {@link promotedTables} record for tables
-     *  no OTHER room/ghost still holds, then run ONE daemon reconcile so entries whose writes had
-     *  staged onto the ghost slice re-invoke and re-stage by provenance onto the daemon slice (the
-     *  removal took their staged copies with the tree; provenance now answers daemon). The whole
-     *  drop runs under one commit boundary so the removal's compensating deltas and the re-staged
-     *  predictions notify as ONE step. After this, a FUTURE upgrade of the same doc promotes
-     *  again from scratch — the round trip is pinned by the §8.5 lanes. */
-    dropGhost(sourceKey, ghost) {
+            this.dropGhost(sourceKey);
+        }
+    }
+    /** Drop one cleared ghost — the 302 §4.2 SWAP-BACK: under the fence the daemon tables are
+     *  value-equal-or-ahead of the room's final state, so (1) every view swapped onto the room's
+     *  namespaced tables re-registers on its ORIGINAL (daemon-table) AST — visually a no-op, the
+     *  Store folds the re-hello as an in-place reset; (2) the namespaced tables unregister (no
+     *  reader is left after the swap); (3) ONE daemon reconcile re-invokes the pending set so any
+     *  entry whose writes had staged onto the now-gone room tables re-stages onto the daemon tables
+     *  (its domain policy stopped naming the dead room when the client dropped it). The whole drop
+     *  runs under one commit boundary so the swap and the re-staged predictions notify as ONE step.
+     *  After this, a FUTURE upgrade of the same doc registers again from scratch. */
+    dropGhost(sourceKey) {
         this.ghosts.delete(sourceKey);
-        // Re-stage eligibility FIRST: a pending entry staged (only) on the ghost slice must join the
-        // daemon reconcile below (the cycle filter is `touchedSources.has(sourceKey)`) — union, never
-        // shrink, the §5.3 rule.
-        let restage = false;
-        for (const p of this.pendingMutations) {
-            if (p.touchedSources.has(sourceKey)) {
-                p.touchedSources.add("daemon");
-                restage = true;
-            }
-        }
         this.inOneCommit(() => {
-            for (const table of ghost.tables)
-                this.local.removeRoomSource(table, sourceKey);
-            for (const table of ghost.tables) {
-                let held = false;
-                for (const byTable of this.roomRouting.values())
-                    if (byTable.has(table))
-                        held = true;
-                for (const g of this.ghosts.values())
-                    if (g.tables.includes(table))
-                        held = true;
-                if (!held)
-                    this.promotedTables.delete(table);
+            for (const [qid, key] of [...this.roomSwappedViews]) {
+                if (key !== sourceKey)
+                    continue;
+                this.roomSwappedViews.delete(qid);
+                const ast = this.asts.get(qid);
+                if (ast === undefined)
+                    continue;
+                this.local.unregisterQuery(qid);
+                this.local.registerQuery(qid, this.plainEngineAst(ast));
             }
-            // One daemon reconcile replays the re-staged entries onto the daemon slice. Run whenever
-            // any pending exists: the removal above may have taken a staged write with the tree even
-            // when `touchedSources` never recorded the ghost (defensive; an empty-pending drop skips).
-            if (restage || this.pendingMutations.length > 0)
+            this.unregisterRoomTables(sourceKey);
+            // One daemon reconcile re-stages the pending set onto the surviving tables. Run whenever
+            // any pending exists: unregistering the room tables took their staged copies with the tree.
+            if (this.pendingMutations.length > 0)
                 this.runReconcileCycle("daemon", []);
         });
         this.refreshPending(); // the reconcile may have dropped a throwing re-invocation
     }
+    /** Unregister room `sourceKey`'s namespaced engine tables and drop the {@link roomTables}
+     *  record. Callers must have no view registered on them (the engine refuses otherwise —
+     *  loud by design). No-op for an unknown sourceKey. */
+    unregisterRoomTables(sourceKey) {
+        const map = this.roomTables.get(sourceKey);
+        if (!map)
+            return;
+        this.roomTables.delete(sourceKey);
+        for (const engineTable of map.values())
+            this.local.unregisterTable(engineTable);
+    }
     // --- the §4 lifecycle SYSTEM-STREAM retains (Slice I-iii) ------------------------------
     /** Retain one minted SYSTEM subscription (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §4, Slice
      *  I-iii): a wire sub with NO store view and NO user-visible table. Registered through the same
@@ -932,201 +949,58 @@ export class OptimisticBackend {
         this.nextMid.set(domain, mid + 1);
         return { mid, seq: ++this.dealSeq };
     }
-    // --- the §3 prove-or-slow-path ROUTER (H-iii) -----------------------------------
-    //
-    // RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §3: a mutation routes to room R iff every row its
-    // prediction run WROTE is provably inside R's writable scope and every read it RECORDED is
-    // provably covered by R's footprint — ANY unproven condition routes slow (the §0 asymmetry:
-    // mis-guessing "slow" costs one round-trip; mis-guessing "room" would commit divergent data).
-    // Failure is therefore SILENT "daemon" — never a throw, never a warning per call — plus the Q6
-    // per-reason counters ({@link RoutingInspect}).
-    //
-    // The proof evaluates against the ENGINE wherever the engine has an answer: `writableMatches`
-    // (the registered compiled writable scope — the same predicate the merge's winner tiering uses)
-    // and `provenanceOf` (the visible overlay-first winner). It runs AFTER the prediction committed,
-    // so the probes see the prediction's own staged effects — which only ever strengthens the
-    // conservative direction (a fresh pk reports "daemon"/undefined and neither disqualifies).
-    //
-    // ** THE ONE CLIENT-SIDE NON-ENGINE EVALUATOR — deliberately minimal (the TS evaluation
-    // caveat). ** Evaluating `footprintWhere` on a read's pk cells ({@link evalFootprintOnPk}) is
-    // the single place Slice H allows a non-engine evaluator, and it is restricted to STRICT cell
-    // equality only: `simple` `=` / `!=` between a pk column and a same-primitive-type non-null
-    // literal, composed under and/or (the empty AND is the vacuous-true exact-unconstrained-root
-    // emission and evaluates true). ANY other op or shape — LIKE, <, >=, IS, IN, null operands,
-    // cross-type comparisons, column-vs-column — is NOT EVALUABLE and fails to the daemon.
-    // Justification: a mis-evaluation here cannot commit divergence — the room GATE (H-iv) re-proves
-    // every write and absent read engine-side at commit and deopts, so a wrong client verdict only
-    // costs a wasted hop (route room → gate deopt) or a skipped optimization (route daemon); and
-    // restricting to strict equality on non-null, same-typed pk cells removes the entire
-    // null/collation/coercion divergence space between this evaluator and the engine's comparators.
-    // The gate remains the contract; this router is the optimization.
+    // --- the DECLARED router (302 §5: declared, not derived) --------------------------------
     //
-    // ** H-v (SHIPPED — the router's missing recovery half). ** A derived (or pinned) room route
-    // whose gate DEOPTS (the H-iv-b `mutationOutcome {kind:"deopt"}` frame — the mid is burnt in
-    // the room ledger, no effects committed) is re-enqueued onto the daemon stream by
-    // {@link handleMutationOutcome}: the entry flips in place (fresh daemon mid, ORIGINAL seq,
-    // prediction applied throughout), or — already retired — re-invokes from the frame's echoed
-    // name/args pinned to the daemon. A reconnect re-sends unconfirmed mids so a frame lost with
-    // its socket is re-answered ({@link resendPending}). A wrong client verdict therefore costs
-    // exactly one room round-trip plus one burnt room-mid (§3.3), never a stranded prediction.
-    /** The route decision for one invocation (invoke, and again at fold flush): the explicit
-     *  `domainPolicy` is the OVERRIDE — a string pins that domain verbatim, no proof runs;
-     *  `undefined` (or no policy configured) derives per §3. */
-    resolveDomain(name, args, writes, reads) {
-        const pinned = this.domainPolicy(name, args);
-        if (pinned !== undefined)
-            return pinned;
-        return this.deriveDomain(writes, reads);
-    }
-    /** §9.3: does this fold's write-set route into a room (vs the daemon)? Used ONLY to pick the
-     *  {@link FoldOptions.roomDebounceMs} cadence at a fold window's start. It probes
-     *  {@link resolveDomain} but RESTORES the Q6 routing diagnostics afterward — the authoritative
-     *  route and its single counter bump belong to the flush ({@link flushFold}), not to this
-     *  interval hint. A fold's reads are provably empty (the read-trap arms on that path), so the
-     *  write-set alone decides. */
-    routesToRoom(name, args, writes) {
-        const reasons = [...this.routingReasons];
-        const derived = [...this.routingDerived];
-        const domain = this.resolveDomain(name, args, writes, { reads: [], queries: [] });
-        this.routingReasons.clear();
-        for (const [k, v] of reasons)
-            this.routingReasons.set(k, v);
-        this.routingDerived.clear();
-        for (const [k, v] of derived)
-            this.routingDerived.set(k, v);
-        return domain !== "daemon";
-    }
-    /** Count one derivation failure ({@link RoutingInspect}). Returns `false` so the per-candidate
-     *  proof's call sites read `return this.failDerivation(...)`. */
-    failDerivation(reason) {
-        this.routingReasons.set(reason, (this.routingReasons.get(reason) ?? 0) + 1);
-        return false;
-    }
-    /** The §3 derivation. Candidates are the connected room gates with at least one promoted table
-     *  (a promoted table with no gate cannot confirm; a gate with no promoted table holds no data to
-     *  prove against). Zero candidates ⇒ `"daemon"` (the single-domain fast path). The proof runs
-     *  per candidate and EXACTLY ONE must survive — two rooms both proving routes slow (principled
-     *  disambiguation is a §9.2 multi-room NON-goal, deferred past Slice J; slow is always sound). */
-    deriveDomain(writes, reads) {
-        const candidates = [];
-        for (const key of this.gates.keys()) {
-            if (key === "daemon")
-                continue;
-            if ((this.roomRouting.get(key)?.size ?? 0) > 0)
-                candidates.push(key);
-        }
-        if (candidates.length === 0) {
-            this.failDerivation("no-candidates");
-            return "daemon";
-        }
-        // tx.query is not room-executable client-side: predicate containment (rindle-cover) is
-        // native-only BY DESIGN, so a declarative read fails the WHOLE derivation unconditionally.
-        // This is required, not conservative.
-        if (reads.queries.length > 0) {
-            this.failDerivation("tx-query");
-            return "daemon";
-        }
-        const proven = candidates.filter((room) => this.provesRoom(room, writes, reads));
-        if (proven.length === 1) {
-            const room = proven[0];
-            this.routingDerived.set(room, (this.routingDerived.get(room) ?? 0) + 1);
-            return room;
-        }
-        if (proven.length > 1)
-            this.failDerivation("ambiguous");
-        return "daemon"; // zero survivors: each candidate already counted its own failure reason
-    }
-    /** One candidate room's §3 proof over the captured write-set + read-log. Every write must pass
-     *  ALL the write rules; every read must pass ONE of the read rules. First failure wins (and is
-     *  counted); order is deterministic (write-set map order, then read-log order). */
-    provesRoom(room, writes, reads) {
-        const specs = this.roomRouting.get(room);
-        // --- write rules: every WriteRecord passes ALL of #1–#4 -------------------------------
-        for (const [table, byPk] of writes) {
-            // #1: the table is promoted for R with a writable (predicate-kind) spec. A context table
-            // (`writable: none`), an un-promoted table, and a local table (unreachable — the mutator
-            // guard refuses local writes at stage time) all fail here.
-            const spec = specs?.get(table);
-            if (spec === undefined || !spec.writable)
-                return this.failDerivation("write-unwritable-table");
-            const colIx = this.colIndex[table];
-            for (const rec of byPk.values()) {
-                const removeShape = rec.row === undefined;
-                // #2: the registered writable scope, evaluated BY THE ENGINE on the post-image for
-                // add/edit shapes and on the pre-image for removes (the row the room would delete). A
-                // remove record always carries its full-width pre-image (the H-ii capture contract);
-                // a violated contract fails closed rather than probing nothing.
-                const scopeRow = removeShape ? rec.oldRow : rec.row;
-                if (scopeRow === undefined || !this.local.writableMatches(table, room, scopeRow)) {
-                    return this.failDerivation("write-scope-miss");
-                }
-                // #3: join-key no-change. An edit-shape (row + oldRow — the oldRow is the txn-entry base)
-                // must keep every joinKeyCols cell STRICTLY identical old-vs-new; an add-shape may SET
-                // them (it creates the correlation); removes are exempt. A join-key column missing from
-                // the schema is a spec bug — fail closed.
-                if (!removeShape && rec.oldRow !== undefined) {
-                    for (const col of spec.joinKeyCols) {
-                        const i = colIx?.get(col);
-                        if (i === undefined || !identicalCell(rec.oldRow[i], rec.row[i])) {
-                            return this.failDerivation("write-join-key-change");
-                        }
-                    }
-                }
-                // #4: provenance corroboration — the engine routes an Edit by its OLD row (H-i), so probe
-                // the pre-image for edit/remove shapes and the post-image for add-shapes. A winner naming
-                // a DIFFERENT room disqualifies; "daemon"/undefined does NOT (a thin slice, or a fresh pk
-                // — fresh pks stage to the daemon slice by the E2 decision, kept permanently: the
-                // room-side authoritative run is the committing execution either way).
-                const probeRow = rec.oldRow ?? rec.row;
-                if (probeRow !== undefined) {
-                    const src = this.local.provenanceOf(table, probeRow);
-                    if (src !== undefined && src !== "daemon" && src !== room) {
-                        return this.failDerivation("write-cross-room-provenance");
-                    }
-                }
-            }
-        }
-        // --- read rules: every ReadRecord passes ONE ------------------------------------------
-        // (tx.query already failed the whole derivation in deriveDomain — never reaches here.)
-        for (const r of reads.reads) {
-            // Self-read: the pk is in THIS invocation's write-set for that table — the write rules
-            // above already judged it (covers the keyed writers' probe-then-write shape). NOTE the
-            // read-log reflects the ORIGINAL invoke only (the pre-existing capture caveat).
-            if (writes.get(r.table)?.has(stableJson(r.pk)))
-                continue;
-            if (r.source !== undefined) {
-                if (r.source === room)
-                    continue; // the room served the row — in-footprint by construction
-                if (r.source !== "daemon")
-                    return this.failDerivation("read-cross-room");
-            }
-            // Present-with-daemon/undefined source, or ABSENT (source is never recorded for those —
-            // including the un-promoted-table meaning of an absent key): the footprint-membership test
-            // on the PK ALONE. R's footprintWhere must exist, be key-decidable (every column it reads is
-            // a pk column), and evaluate TRUE on the read's pk cells:
-            //   present-daemon + TRUE  ⇒ the row is in the room's COMPLETE footprint ⇒ covered;
-            //   absent + TRUE          ⇒ absent-in-room = absent-in-truth ⇒ covered;
-            //   FALSE (either outcome) ⇒ fail — present-daemon-FALSE means the room lacks the row;
-            //     absent-FALSE is arguably provable (decidably-outside ⇒ the room never sees the pk)
-            //     but the room-side run would then read absent for a DIFFERENT reason than truth's —
-            //     stay CONSERVATIVE and fail;
-            //   no footprintWhere / not key-decidable / not evaluable ⇒ fail (see the evaluator caveat
-            //     on the router block comment).
-            const fw = specs?.get(r.table)?.footprintWhere;
-            if (fw === undefined)
-                return this.failDerivation("read-no-footprint-where");
-            const tspec = this.specs[r.table];
-            const pkCols = tspec.primaryKey.map((i) => tspec.columns[i]);
-            if (!keyDecidable(fw, new Set(pkCols)))
-                return this.failDerivation("read-not-key-decidable");
-            const pkCells = new Map(pkCols.map((c, j) => [c, r.pk[j]]));
-            const verdict = evalFootprintOnPk(fw, pkCells);
-            if (verdict === undefined)
-                return this.failDerivation("read-not-evaluable");
-            if (!verdict)
-                return this.failDerivation("read-outside-footprint");
-        }
-        return true;
+    // The user declares which mutators are room mutators; the client neither proves, derives,
+    // widens, nor falls back. The declaration reaches this backend as `domainPolicy` — the client
+    // layer resolves (mutator name, args) against its declared realtime mutators and the currently
+    // attached rooms. A misdeclaration fails SOFT (302 §5.1): a daemon-declared mutator touching
+    // room-visible data stages onto the daemon tables while the room-homed view reads the room
+    // tables — no optimistic feedback until the echo relays it a hop later, never a divergence.
+    // The room GATE stays the authoritative backstop: a room-routed mutation the room refuses comes
+    // back as a `mutationOutcome` deopt/reject frame and the H-v machinery below re-enqueues or
+    // surfaces it.
+    /** The declared confirming stream for one invocation: the `domainPolicy`'s verdict, `"daemon"`
+     *  when it abstains. Resolved BEFORE the prediction runs — the domain picks the staging map
+     *  (a room domain stages its owned tables onto the room's namespaced twins). */
+    resolveDomain(name, args) {
+        return this.domainPolicy(name, args) ?? "daemon";
+    }
+    /** The staging table map for a `domain`-routed prediction ({@link trackingTx}'s `stage`):
+     *  wire table → the room's namespaced engine table for the tables the room owns; identity for
+     *  everything else (including the whole map for the daemon domain). */
+    stagingMap(domain) {
+        return domain === "daemon" ? undefined : this.roomTables.get(domain);
+    }
+    /** The PLAIN (daemon-homed) engine AST for `ast` — aggregate relationships rewritten to their
+     *  synthetic `__agg_*` reads, no room renames. The ONE form every non-swapped engine
+     *  registration uses ({@link registerQuery}, {@link dropGhost}'s swap-back) and the base the
+     *  swap-in renames ({@link processSwapIns}). */
+    plainEngineAst(ast) {
+        return rewriteAggregates(ast, (t) => this.localTables.has(t));
+    }
+    /** Mutator names the cross-authority warn below already fired for (once per name). */
+    warnedCrossAuthority = new Set();
+    /** 302 §5.1 dev-time guard: a room-DECLARED mutator wrote tables the room does not own. Those
+     *  writes staged onto the PLAIN daemon tables (the staging map covers only owned tables), but
+     *  the entry confirms on the ROOM stream — and only the room's OWNED tables flush back to the
+     *  daemon, so nothing upstream ever echoes them: once the room confirm retires the entry, the
+     *  next release's whole-store rewind reverts them for good. The first-party room shell refuses
+     *  such a mutation (the §3.3 deopt/reject backstop re-routes it to the daemon), so this warns
+     *  for the shapes where that backstop may be absent (a BYO relay) — loud, once, soft (§5.1:
+     *  misdeclarations never throw). */
+    warnCrossAuthorityWrites(name, domain, touched) {
+        if (domain === "daemon" || this.warnedCrossAuthority.has(name))
+            return;
+        const map = this.roomTables.get(domain);
+        const staged = new Set(map?.values() ?? []);
+        const outside = [...touched].filter((t) => !staged.has(t));
+        if (outside.length === 0)
+            return;
+        this.warnedCrossAuthority.add(name);
+        console.warn(`[rindle] room mutator "${name}" wrote table(s) ${outside.join(", ")} that room ${JSON.stringify(domain)} does not own` +
+            ` (owned: ${map !== undefined && map.size > 0 ? [...map.keys()].join(", ") : "none"}) — these writes rely on the room` +
+            ` shell's deopt backstop and revert after the room confirm if the shell applies the mutation anyway (302 §5.1).`);
     }
     /** Run the named client mutator optimistically: the prediction applies to the live
      *  engine now (affected views update synchronously), `(mid, name, args)` joins the
@@ -1147,43 +1021,33 @@ export class OptimisticBackend {
         // One commit boundary spans the prediction AND the `__agg`-head reconcile below, so their views
         // (data + count) flush together rather than tearing across two engine commits.
         return this.inOneCommit(() => {
-            // Apply the prediction FIRST. If the mutator throws (client-side validation, a bad read),
+            // The confirming stream is DECLARED (302 §5), so it resolves BEFORE the prediction: the
+            // domain picks the staging map — a room-domain mutator's writes to the room's owned tables
+            // land on the namespaced engine twins the room-homed views read. An H-v deopt re-invocation
+            // pins via `pin` and the policy never runs.
+            const domain = pin ?? this.resolveDomain(name, args);
+            // Apply the prediction. If the mutator throws (client-side validation, a bad read),
             // the staged write is discarded (the wasm txn is a clean no-op until commit) and the throw
             // propagates with NO mid consumed — a burnt mid is a permanent server-side gap that
             // silently refuses every later mutation from this client (#10).
             const writes = new Map();
             const reads = { reads: [], queries: [] };
             const ops = [];
-            // Per-staged-write source keys (staged order), zipped with the `commitTracked` `sources[]`
-            // below to learn which physical source each pk routed onto (§5.3 filter + §7.3 hold-back).
-            const stagedKeys = [];
-            const sources = this.local.writeWith((tx) => {
-                this.runMutator(mutator, 
-                // `readProvenance` rides only with recording (H-ii §3.2 #3): the folded path (trap, no
-                // readLog) and the reconcile replay (no readLog) never probe — see trackingTx.
-                trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, reads, stagedKeys, this.readProvenance), args);
+            this.local.writeWith((tx) => {
+                this.runMutator(mutator, trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, reads, this.stagingMap(domain)), args);
             });
             // `touched` is DERIVED, never separately populated (§3.2 #1) — see {@link WriteSet}.
             const touched = new Set(writes.keys());
+            this.warnCrossAuthorityWrites(name, domain, touched);
             // Flush-on-enqueue (§4.2): a fold whose tables overlap this write must take its mid NOW, BEFORE
             // this write does, so wire order == local-apply order for any pair that can observe each other
             // (a read-dependent write reading a folded cell sees the same value optimistically and on the
             // wire — no snap). Drained folds ship with smaller mids; this write's mid is dealt after.
             this.drainOverlapping(touched);
-            // The confirming stream (§7.1): its ledger deals the mid and its watermark alone retires the
-            // entry. THE §3 ROUTER RUNS HERE (H-iii) — after the prediction (write/read capture is
-            // complete, and the engine holds the committed prediction the probes read) and BEFORE the
-            // mid is dealt: an assigned mid pins its domain forever (§7.1) — a re-invocation never
-            // re-routes. An explicit `domainPolicy` string pins verbatim (no proof); an H-v deopt
-            // re-invocation pins via `pin` (see {@link invokeWith}) and the router never runs.
-            const domain = pin ?? this.resolveDomain(name, args, writes, reads);
+            // The confirming stream's ledger deals the mid and its watermark alone retires the entry
+            // (§7.1). An assigned mid pins its domain forever — a re-invocation never re-routes.
             const { mid, seq } = this.dealMid(domain);
-            // The write-source axes (§5.3): which physical source each write staged onto. All `"daemon"`
-            // in single-domain (Collapsed) — so the filter and hold-back below are inert on the live path.
-            const touchedSources = new Set(sources);
-            const writeSources = new Map();
-            mergeWriteSources(writeSources, stagedKeys, sources);
-            this.pendingMutations.push({ mid, seq, name, args, domain, touched, writes, reads, touchedSources, writeSources });
+            this.pendingMutations.push({ mid, seq, name, args, domain, touched, writes, reads });
             // The prediction stuck — fold its child ops into the optimistic agg delta and push it onto
             // the `__agg` head rows (§4). No reset here (this is the §1.3 trivial case, no rewind): the
             // delta accumulates on top of the prior pending set, and `reconcileAggHead` recomputes each
@@ -1207,6 +1071,9 @@ export class OptimisticBackend {
         const foldKey = `${name}\0${stableJson(opts.key)}`;
         // One commit boundary spans the prediction AND the `__agg`-head reconcile (see {@link inOneCommit}),
         // so a folded mutation's list view and count view flush together, never torn across two commits.
+        // The declared domain (302 §5) — resolved up front, like `invoke`'s: it picks the staging
+        // map, the §9.3 cadence, and the provisional confirming stream (the flush re-resolves).
+        const domain = this.resolveDomain(name, args);
         return this.inOneCommit(() => {
             // Apply the prediction with the read trap armed (§5): a folded mutator that reads state to
             // compute its write is non-absorbing and refused. A throw discards the staged write (clean
@@ -1214,11 +1081,9 @@ export class OptimisticBackend {
             // path stays byte-for-byte as it was; recording (§3.2 #2) never arms alongside the trap.
             const writes = new Map();
             const ops = [];
-            const stagedKeys = [];
-            let sources = [];
             try {
-                sources = this.local.writeWith((tx) => {
-                    this.runMutator(mutator, trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), true, undefined, stagedKeys), args);
+                this.local.writeWith((tx) => {
+                    this.runMutator(mutator, trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), true, undefined, this.stagingMap(domain)), args);
                 });
             }
             catch (e) {
@@ -1232,38 +1097,31 @@ export class OptimisticBackend {
             this.reconcileAggHead();
             // `touched` is DERIVED, never separately populated (§3.2 #1) — see {@link WriteSet}.
             const touched = new Set(writes.keys());
-            // The write-source axes (§5.3), like `touched`/`writes` — REPLACED wholesale on an in-place
-            // fold overwrite (the latest invocation supersedes, absorbing), initialized on a new entry.
-            const touchedSources = new Set(sources);
-            const writeSources = new Map();
-            mergeWriteSources(writeSources, stagedKeys, sources);
+            this.warnCrossAuthorityWrites(name, domain, touched);
             const now = this.clock.now();
             let f = this.folds.get(foldKey);
             if (f) {
                 // Overwrite the single entry in place — the pending stack does NOT grow (§1 #2). The head
                 // already carries this new prediction (absorbing, last-wins on the cell); the entry holds
                 // only the LATEST args, which is what a rebase re-derives from and what the flush ships.
+                // `domain` too: THIS invocation staged through the freshly-resolved domain's map above, so
+                // a mid-window rebase must re-stage through the same one (the flush re-resolves anyway;
+                // no mid is pinned yet — `entry.mid` is null until flush).
                 f.entry.args = args;
                 f.entry.touched = touched;
                 f.entry.writes = writes;
-                f.entry.touchedSources = touchedSources;
-                f.entry.writeSources = writeSources;
+                f.entry.domain = domain;
                 f.args = args;
                 this.clock.clearTimeout(f.timer);
             }
             else {
-                // Provisional domain (§7.1): re-resolved from the final args/write-set at flush, when the
-                // mid is dealt. Never read before then — an un-flushed fold (`mid == null`) is
-                // unconditionally retained — so the full (counting) derivation deliberately does NOT run
-                // here (it would double-bump the Q6 counters for one logical route); the flush derives.
-                const domain = this.domainPolicy(name, args) ?? "daemon";
                 // §9.3: pick the window's cadence. Routing into a room ⇒ flush at roomDebounceMs so
                 // intermediates stream to the shared head; off the room, the caller's collapse debounce
-                // governs. The probe restores the Q6 diagnostics (the flush owns the authoritative bump).
-                const inRoom = opts.roomDebounceMs !== undefined && this.routesToRoom(name, args, writes);
+                // governs.
+                const inRoom = opts.roomDebounceMs !== undefined && domain !== "daemon";
                 const debounceMs = inRoom ? opts.roomDebounceMs : opts.debounceMs ?? DEFAULT_FOLD_DEBOUNCE_MS;
                 const maxWaitMs = inRoom ? opts.roomDebounceMs : opts.maxWaitMs;
-                const entry = { mid: null, seq: null, name, args, domain, touched, writes, reads: { reads: [], queries: [] }, touchedSources, writeSources };
+                const entry = { mid: null, seq: null, name, args, domain, touched, writes, reads: { reads: [], queries: [] } };
                 this.pendingMutations.push(entry);
                 let resolveMid;
                 const midPromise = new Promise((res) => (resolveMid = res));
@@ -1315,13 +1173,11 @@ export class OptimisticBackend {
             return;
         this.clock.clearTimeout(f.timer);
         this.folds.delete(foldKey);
-        // Resolve the confirming stream from the FINAL args (§7.1) and deal the mid from that domain's
-        // ledger — SEND order, never reserved, so gapless within the domain. Under H-iii derivation
-        // this RE-DERIVES from the entry's LATEST write-set (each in-place fold overwrite replaced it,
-        // so it reflects the final absorbed value): same §3 rules minus reads — a fold's read-set is
-        // provably empty by construction (the FoldReadError trap, not recording, arms on that path),
-        // which is the STRONGEST read proof there is. The mid dealt below then pins this domain.
-        const domain = this.resolveDomain(f.entry.name, f.args, f.entry.writes, f.entry.reads);
+        // Re-resolve the DECLARED confirming stream from the FINAL args (§7.1) and deal the mid from
+        // that domain's ledger — SEND order, never reserved, so gapless within the domain. The mid
+        // dealt below then pins this domain. (A domain that changed since the window opened — a room
+        // attached or dropped mid-window — re-stages on the next reconcile's re-invocation.)
+        const domain = this.resolveDomain(f.entry.name, f.args);
         f.entry.domain = domain;
         const { mid, seq } = this.dealMid(domain);
         f.entry.mid = mid;
@@ -1433,8 +1289,7 @@ export class OptimisticBackend {
             }, frame.reason ?? "mutation rejected");
             return;
         }
-        // kind === "deopt": Q6's completion — how often a routed mutation came back refused.
-        this.routingReasons.set("deopt", (this.routingReasons.get("deopt") ?? 0) + 1);
+        // kind === "deopt": the room gate refused a declared-room mutation — re-enqueue onto the daemon.
         const entry = this.pendingMutations.find((p) => p.domain === domain && p.mid === frame.mid);
         if (entry) {
             entry.domain = "daemon";
@@ -1617,37 +1472,14 @@ export class OptimisticBackend {
         return {
             nextMid: Object.fromEntries(this.nextMid),
             watermark: Object.fromEntries(this.watermark),
-            gates: Object.fromEntries([...this.gates].map(([k, g]) => [
-                k,
-                {
-                    appliedCv: g.appliedCv,
-                    bufferedFrames: g.buffer.length,
-                    ...(g.upstreamCv !== undefined ? { upstreamCv: g.upstreamCv } : {}),
-                    ...(g.upstreamBoot !== undefined ? { upstreamBoot: g.upstreamBoot } : {}),
-                },
-            ])),
-            routing: {
-                derived: Object.fromEntries(this.routingDerived),
-                reasons: Object.fromEntries(this.routingReasons),
-            },
+            gates: Object.fromEntries([...this.gates].map(([k, g]) => [k, { appliedCv: g.appliedCv, bufferedFrames: g.buffer.length }])),
+            roomTables: Object.fromEntries([...this.roomTables].map(([k, m]) => [k, Object.fromEntries(m)])),
+            swappedViews: Object.fromEntries(this.roomSwappedViews),
             lifecycle: {
                 roomWatermarks: Object.fromEntries(this.roomWatermarks),
                 scopeSessions: Object.fromEntries([...this.scopeSessions].map(([scope, sessions]) => [scope, Object.fromEntries(sessions)])),
-                ghosts: Object.fromEntries([...this.ghosts].map(([k, g]) => [k, { doc: g.doc, finalFlushSeq: g.finalFlushSeq, tables: [...g.tables] }])),
+                ghosts: Object.fromEntries([...this.ghosts].map(([k, g]) => [k, { doc: g.doc, finalFlushSeq: g.finalFlushSeq }])),
             },
-            pins: Object.fromEntries([...this.pins].map(([k, p]) => [
-                k,
-                {
-                    table: p.table,
-                    sourceKey: p.sourceKey,
-                    domain: p.domain,
-                    mid: p.mid,
-                    ...(p.daemonBoot !== undefined ? { daemonBoot: p.daemonBoot } : {}),
-                    ...(p.daemonCv !== undefined ? { daemonCv: p.daemonCv } : {}),
-                    tripwired: p.tripwired === true,
-                },
-            ])),
-            daemonCarriedLmid: Object.fromEntries(this.daemonCarriedLmid),
             pending: this.pendingMutations.map((p) => ({
                 mid: p.mid,
                 // The client-global deal sequence — the REPLAY order (mids are per-domain, incomparable
@@ -1655,11 +1487,6 @@ export class OptimisticBackend {
                 seq: p.seq,
                 name: p.name,
                 domain: p.domain,
-                // The write-source axes (§5.3): which physical source(s) this entry's writes routed onto —
-                // the filter basis, and (per pk) the hold-back's cross-slice test. The harness asserts the
-                // filter/routing against its independent model with these.
-                touchedSources: [...p.touchedSources],
-                writeSources: Object.fromEntries(p.writeSources),
             })),
         };
     }
@@ -1761,16 +1588,6 @@ export class OptimisticBackend {
      *  delta, lmid → watermark) and {@link applyRelease} (per-source confirm-drop + reconcile) —
      *  N independent gates all feed the ONE apply half; {@link __testRelease} drives it directly. */
     onGateProgress(gate, frame) {
-        // §301 direction B: record the frame's upstream-absorption advert BEFORE the release applies,
-        // so the drop pass at applyRelease's tail evaluates exactly this release's advert — the room
-        // emits data-then-progress on one socket, so by the time the advert says "absorbed through
-        // cv U" the re-published echo data is in this release's fold (never ahead of it). Verbatim,
-        // not max-folded: on a daemon restart the advertised cv space legitimately resets and the
-        // §2.4 boot rule (not monotonicity) carries the ordering.
-        if (frame.upstreamCv !== undefined) {
-            gate.upstreamCv = frame.upstreamCv;
-            gate.upstreamBoot = frame.upstreamBoot;
-        }
         const { deltas, newlyHydrated, touchedScopes } = this.computeRelease(gate, frame);
         this.applyRelease(gate.key, deltas, undefined, newlyHydrated);
         // I-iv phase 2: a retargeted sub whose first ROOM snapshot released just now gets its old
@@ -1825,7 +1642,10 @@ export class OptimisticBackend {
                 this.foldLmidOps(f.ops, gate.key);
                 continue;
             }
-            muts.push(...(f.kind === "snapshot" ? gate.sync.rehydrate(f.qid, f.ops) : gate.sync.applyBatch(f.qid, f.ops)));
+            // A ROOM gate's deltas rename into the room's namespaced tables — and a wire table outside
+            // the registered map is DROPPED (302 §6: context comes from the daemon, one authority per
+            // table; a room's relayed context copy must never enter the store).
+            muts.push(...mapGateDeltas(gate, f.kind === "snapshot" ? gate.sync.rehydrate(f.qid, f.ops) : gate.sync.applyBatch(f.qid, f.ops)));
             // A query's first released snapshot is its hydration point — even an empty one (0 rows is an
             // authoritative answer): lift every local view this sub feeds out of `unknown` (loading).
             if (f.kind === "snapshot")
@@ -1850,44 +1670,6 @@ export class OptimisticBackend {
         if (watermarkUpdate !== undefined) {
             this.watermark.set(sourceKey, Math.max(this.watermark.get(sourceKey) ?? 0, watermarkUpdate));
         }
-        // Echo hold-back (§7.3), BEFORE the confirm-drop: an entry `p` this release CONFIRMS
-        // (`p.mid <= watermark[p.domain]`) but which staged a write onto a DIFFERENT source `S` (a
-        // cross-slice write — e.g. a room-domain mutation whose write routed to the daemon slice) is
-        // about to leave `pendingMutations`, so it will NOT be re-invoked on `S`'s next rewind. Park each
-        // such write inertly on `S` so that rewind (which un-applies the not-re-invoked write) does not
-        // flash-revert it. Two variants, one per write shape (G-i unified them engine-side):
-        //   - ADD/EDIT (`rec.row` present): pinned PRESENCE — drops when `S`'s confirmed baseline
-        //     value-matches (its echo lands — the E-i-tested drop).
-        //   - REMOVE (`rec.row === undefined`, G-iii): pinned ABSENCE — the §7.3 tombstone, parked with
-        //     the captured pre-image (`rec.oldRow`) so `S`'s rewind cannot resurrect the deleted row;
-        //     drops when `S`'s baseline lacks the pk (the delete echoed).
-        // Inert in single-domain: every write's source equals its domain.
-        for (const p of this.pendingMutations) {
-            if (p.mid === null || p.mid > (this.watermark.get(p.domain) ?? 0))
-                continue; // not confirmed now
-            for (const [table, byPk] of p.writes) {
-                // The Collapsed-park gate (G-iii): NEVER park on an un-promoted table. Inert-anyway today
-                // (`rewind_collapsed` never consults `held_back`), so skipping is behaviorally identical —
-                // but a stale Collapsed-era entry would become overlay-first-visible (a permanent pin) if
-                // the table later promotes. Slice H's prove-or-slow-path routing makes the real scenario
-                // (a room-confirmed mutation writing a Collapsed table) impossible; this covers until then.
-                if (!this.promotedTables.has(table))
-                    continue;
-                for (const [pkKey, rec] of byPk) {
-                    const s = p.writeSources.get(writeSourceKey(table, pkKey));
-                    if (s === undefined || s === p.domain)
-                        continue; // same-slice: the rewind replays it
-                    if (rec.row !== undefined)
-                        this.local.holdBack(table, s, rec.row);
-                    else if (rec.oldRow !== undefined)
-                        this.local.holdBackAbsent(table, s, rec.oldRow);
-                    else
-                        continue;
-                    // §301 §2.1: register the pin's delivery-fence inputs in the same breath as the park.
-                    this.registerPin(table, s, pkKey, rec.row ?? rec.oldRow, p);
-                }
-            }
-        }
         // Drop confirmed pending (§1.3 step 5's bookkeeping half), PER DOMAIN: an entry is retired only
         // when ITS domain's watermark reaches its mid — so two concurrent streams never alias one counter
         // (§7.1). A failed mutation drops the same way (the release carries no effects, so the rewind snaps
@@ -1936,11 +1718,11 @@ export class OptimisticBackend {
                 this.handler(qid, { type: "batch", events: [], catchUp: true });
         }
         this.refreshPending();
-        // The §301 echo-fence drop pass — strictly AFTER the reconcile above folded this release's
-        // data, so a fence that cleared in this release drops its pin only once the co-committed
-        // echo data is actually in the baseline (dropping earlier would itself reopen the flash
-        // window §7.3 closes). Structural no-op with no pins (every single-domain client).
-        this.dropEchoFencePins();
+        // The 302 §4.1 swap-in — strictly AFTER the reconcile above folded this release's data, so a
+        // room sub whose first snapshot just released swaps its views onto room tables that already
+        // hold the snapshot (swapping earlier would hydrate them empty). Structural no-op with no
+        // pending swap (every single-domain client).
+        this.processSwapIns();
         // The I-v ghost-drop watcher (§4.2), LAST: this release's watermark rows have folded
         // (computeRelease) and its confirm-drop has retired what it covers — exactly the two inputs
         // the drop condition reads. Structural no-op with no ghost.
@@ -1954,151 +1736,62 @@ export class OptimisticBackend {
     __testRelease(sourceKey, deltas, watermarkUpdate) {
         this.applyRelease(sourceKey, deltas, watermarkUpdate);
     }
-    // --- the §301 echo fences (301-ECHO-FENCE-DESIGN.md) -----------------------------------
-    /** Register (or overwrite — a later cross-slice confirm re-pinning the same slice-pk matches
-     *  the engine's `held_back.insert`) one {@link EchoFencePin}, in the same breath as the
-     *  engine park (§2.1). `p` is the confirmed entry whose write staged onto `sourceKey`; its
-     *  `mid` is non-null by the caller's confirm filter. */
-    registerPin(table, sourceKey, pkKey, probeRow, p) {
-        const pin = {
-            table,
-            sourceKey,
-            probeRow,
-            domain: p.domain,
-            mid: p.mid,
-        };
-        if (sourceKey !== "daemon" && p.domain === "daemon") {
-            // Direction B stamps (§1.2): the parking daemon release's coherence position — the confirm
-            // folded at-or-before it, so a room advertising absorption ≥ this cv has absorbed the
-            // commit that carried the write — plus the client-observed boot it belongs to (§2.4).
-            pin.daemonCv = this.daemonGate.appliedCv;
-            if (this.daemonBootId !== undefined)
-                pin.daemonBoot = this.daemonBootId;
-        }
-        // The tripwire reference (§2.5): the slice's confirmed-baseline row at park.
-        pin.baselineAtPark = this.local.heldBackState(table, sourceKey, probeRow)?.baseline;
-        this.pins.set(`${table}\0${sourceKey}\0${pkKey}`, pin);
-    }
-    /** The §2.3 drop pass, run at the tail of every applied release: prune registry entries whose
-     *  engine pin is already gone (the rewind's state-match fallback or a whole-source removal beat
-     *  the fence — benign), drop every pin whose fence cleared (one engine drop each, delivered on
-     *  the ordinary event stream, bracketed as ONE notification commit), and tripwire the rest. */
-    dropEchoFencePins() {
-        if (this.pins.size === 0)
-            return; // every single-domain client: structural no-op
-        let cleared = null;
-        for (const [key, pin] of this.pins) {
-            const state = this.local.heldBackState(pin.table, pin.sourceKey, pin.probeRow);
-            if (state === undefined) {
-                this.pins.delete(key); // engine pin gone (state-match / source removal): lazy prune
-                continue;
-            }
-            if (this.pinFenceCleared(pin))
-                (cleared ??= []).push([key, pin]);
-            else
-                this.maybeTripwirePin(key, pin, state.baseline);
-        }
-        if (!cleared)
-            return;
+    // --- the 302 §4 swap-in ------------------------------------------------------------------
+    /** Swap every view of each just-hydrated ROOM sub onto the room's namespaced tables (302 §4.1):
+     *  re-register the local engine query with the AST's room-owned table references renamed
+     *  ({@link remapAstTables}); the Store folds the re-hello as an in-place reset, so the caller's
+     *  view reference survives and subscribers see ONE transition. Runs at the applyRelease tail —
+     *  the reconcile has already folded the sub's snapshot into the room tables, so the swapped
+     *  view hydrates straight to the room state (swapping earlier would flash it empty). The
+     *  ORIGINAL ast stays in {@link asts}; the swap-back ({@link dropGhost}) re-registers it.
+     *
+     *  This is the accepted-flash boundary (302 §4.1/§7.1): the room's copy may be behind the
+     *  daemon rows the view showed a moment ago — accepted by decision, revisit on a real
+     *  two-region deploy. */
+    processSwapIns() {
+        if (this.pendingSwapIns.size === 0)
+            return; // every single-domain release: structural no-op
+        const subs = [...this.pendingSwapIns];
+        this.pendingSwapIns.clear();
         this.inOneCommit(() => {
-            for (const [key, pin] of cleared) {
-                this.pins.delete(key);
-                this.local.dropHeldBack(pin.table, pin.sourceKey, pin.probeRow);
+            for (const sub of subs) {
+                const map = this.roomTables.get(sub.channel);
+                for (const qid of sub.localQids.keys()) {
+                    const ast = this.asts.get(qid);
+                    if (ast === undefined)
+                        continue;
+                    // 302 §6.1 coverage check, BEFORE the owned-table gate (an all-context room swaps
+                    // nothing yet still starves every ref): any referenced table the room does not own
+                    // keeps reading the PLAIN daemon tables after the swap — legal (the client-side join
+                    // across kinds), but the rows render only if a daemon subscription covers them, which
+                    // is unknowable here. Surface once per view, loudly, so a silently-empty join is a
+                    // named condition. Local-only tables are daemon-free by definition — skip them.
+                    if (!this.contextJoinWarned.has(qid)) {
+                        const uncovered = [...collectTables(ast)].filter((t) => !(map?.has(t) ?? false) && !this.localTables.has(t));
+                        if (uncovered.length > 0) {
+                            this.contextJoinWarned.add(qid);
+                            this.roomContextJoinHandler({ sourceKey: sub.channel, name: sub.remote.name, args: sub.remote.args, tables: uncovered });
+                        }
+                    }
+                    if (map === undefined || map.size === 0)
+                        continue; // no owned tables — nothing to swap
+                    if (this.roomSwappedViews.get(qid) === sub.channel)
+                        continue; // already swapped
+                    const rewritten = remapAstTables(this.plainEngineAst(ast), map);
+                    this.local.unregisterQuery(qid);
+                    this.local.registerQuery(qid, rewritten);
+                    this.roomSwappedViews.set(qid, sub.channel);
+                    // The pending axis follows the engine tables the view now reads (union — the wire
+                    // names stay too, conservatively: a daemon-declared write to a room-visible table is
+                    // still an honest "pending elsewhere" signal).
+                    const tables = this.queryTables.get(qid);
+                    if (tables)
+                        for (const t of map.values())
+                            tables.add(t);
+                }
             }
         });
     }
-    /** Has `pin`'s delivery fence provably closed its confirm→echo window? (§2.3/§2.4.) */
-    pinFenceCleared(pin) {
-        if (pin.sourceKey === "daemon") {
-            // Direction A: the daemon-carried ledger for the confirming room domain covers the mid —
-            // the I-ii co-commit means this release (or an earlier one) folded the flush data that
-            // carried it into the daemon baseline (§1.1).
-            return (this.daemonCarriedLmid.get(pin.domain) ?? 0) >= pin.mid;
-        }
-        // Direction B: only a daemon-confirmed write has the daemon-cv stamp; a room-staged pin
-        // confirmed by ANOTHER room (outside today's two-tier topology) has no fence.
-        if (pin.daemonCv === undefined)
-            return false;
-        const gate = this.gates.get(pin.sourceKey);
-        if (!gate || gate.upstreamCv === undefined)
-            return false; // no advert (old shell): §2.5 fallback
-        if (gate.upstreamBoot === pin.daemonBoot)
-            return gate.upstreamCv >= pin.daemonCv;
-        // Boot mismatch (§2.4): a boot the client has OBSERVED as later proves absorption (the
-        // room's post-restart re-snapshot came from daemon state that durably includes the
-        // confirmed write); an unknown/older/unstamped boot holds — conservative, its next
-        // re-snapshot advances it.
-        if (pin.daemonBoot === undefined || gate.upstreamBoot === undefined)
-            return false;
-        const pinOrd = this.daemonBootOrdinals.get(pin.daemonBoot);
-        const advOrd = this.daemonBootOrdinals.get(gate.upstreamBoot);
-        return pinOrd !== undefined && advOrd !== undefined && advOrd > pinOrd;
-    }
-    /** The §2.5 stuck-pin tripwire, in the scopesHash spirit: log ONCE per pin when its slice's
-     *  baseline row has CHANGED VALUE since park while the pin still holds — the suspicious state
-     *  that precedes every forever-pin (a fence-less pairing, a fence bug). Never drops anything. */
-    maybeTripwirePin(key, pin, baseline) {
-        if (pin.tripwired)
-            return;
-        const same = pin.baselineAtPark === undefined || baseline === undefined
-            ? pin.baselineAtPark === baseline
-            : pin.baselineAtPark.length === baseline.length &&
-                pin.baselineAtPark.every((c, i) => identicalCell(c, baseline[i]));
-        if (same)
-            return;
-        pin.tripwired = true;
-        const [table, sourceKey, pkKey] = key.split("\0");
-        console.warn(`rindle: a §7.3 hold-back pin on table "${table}" slice "${sourceKey}" pk ${pkKey} (confirming domain ${pin.domain}, mid ${pin.mid}) is parked while its slice's baseline moved past it — if this client never converges on that row, this pin is why (301-ECHO-FENCE-DESIGN.md §2.5).`);
-    }
-    /** Record one observed daemon boot id (§2.4): first observation of an id assigns the next
-     *  ordinal (the client's own total order over opaque boot ids); every call refreshes the
-     *  current-boot stamp for direction-B parks. */
-    observeDaemonBoot(bootId) {
-        if (!this.daemonBootOrdinals.has(bootId)) {
-            this.daemonBootOrdinals.set(bootId, this.daemonBootOrdinals.size);
-        }
-        this.daemonBootId = bootId;
-    }
-    /** Promote `table` to a MERGED multi-source engine with room `sourceKey`'s per-row writable
-     *  scope (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §5.2) — THE one promotion seam. The engine
-     *  attach and the {@link promotedTables} record move in the same breath: the §7.3 hold-back
-     *  trigger in {@link applyRelease} parks ONLY on promoted tables, so a promotion that bypassed
-     *  the record would silently disable the echo hold-back for that table (and a record without the
-     *  engine attach would park onto a slice that doesn't exist). Recorded AFTER the engine accepts —
-     *  a rejected descriptor/table must not leave a phantom promotion. Slice G-v's client drives this
-     *  from the lease's `realtime.tables` (`RoomTableSpec` → {@link WritableDescriptor}); idempotence
-     *  per `(sourceKey, table)` is the CALLER's job (the engine refuses a duplicate room).
-     *
-     *  `spec` (H-iii) is the per-table ROUTING spec riding the same lease table block — recorded
-     *  into {@link roomRouting} (THE routing table the §3 router reads) in the same breath, with
-     *  `writable` derived from the descriptor's kind (`none` = a context table the room may not
-     *  write). Omitted (the E-iii-b harness alias below) ⇒ an empty spec: no join keys to guard, no
-     *  `footprintWhere` (that room's reads then fail closed to the daemon unless self/room-served). */
-    promoteRoomTable(table, sourceKey, writable, spec) {
-        this.local.addRoomSource(table, sourceKey, writable);
-        this.promotedTables.add(table);
-        let byTable = this.roomRouting.get(sourceKey);
-        if (!byTable)
-            this.roomRouting.set(sourceKey, (byTable = new Map()));
-        byTable.set(table, {
-            writable: writable.kind !== "none",
-            joinKeyCols: [...(spec?.joinKeyCols ?? [])],
-            ...(spec?.where !== undefined ? { where: spec.where } : {}),
-            ...(spec?.footprintWhere !== undefined ? { footprintWhere: spec.footprintWhere } : {}),
-        });
-    }
-    /** The recorded routing specs for `sourceKey`'s promoted tables (table → its
-     *  {@link RoomTableRouting}) — read-only: the client's `__realtimeInspect`/idempotence
-     *  bookkeeping reads THIS record instead of keeping its own shadow copy (one source of truth).
-     *  Empty map when the room has promoted nothing. */
-    roomTablesFor(sourceKey) {
-        return this.roomRouting.get(sourceKey) ?? EMPTY_ROUTING;
-    }
-    /** Test-named alias of {@link promoteRoomTable} (E-iii-b scaffolding — the multi-domain oracle
-     *  and per-source-gate suites drive it). Pure delegation: ONE body, one `promotedTables` record. */
-    __addRoomSource(table, roomKey, writable, spec) {
-        this.promoteRoomTable(table, roomKey, writable, spec);
-    }
     /** Fold `domain`'s lmid system query's released ops (lmid-as-data): the one row's
      *  `last_mutation_id` cell is this client's confirmed high-water mid in that domain — it advances
      *  `watermark[domain]` and, on a fresh session ahead of our issued mids, `nextMid[domain]`. The
@@ -2232,16 +1925,7 @@ export class OptimisticBackend {
                     continue;
                 if (spec.doc !== undefined && doc !== spec.doc)
                     continue;
-                const covered = Number(lmid);
-                this.foldConfirm(roomDomainKey(doc), covered);
-                // The §301 direction-A fence input: the DAEMON-CARRIED ledger fold ALONE (the room
-                // socket's own lmid stream confirms long before the flush reaches the daemon, so it
-                // folds the shared watermark above but never this map — 301 §1.1). Max-fold: ledger
-                // rows re-deliver across re-hydrates.
-                if (Number.isFinite(covered)) {
-                    const dom = roomDomainKey(doc);
-                    this.daemonCarriedLmid.set(dom, Math.max(this.daemonCarriedLmid.get(dom) ?? 0, covered));
-                }
+                this.foldConfirm(roomDomainKey(doc), Number(lmid));
             }
         }
         // (3) watermark rows → the monotone §4.2 fence value per doc.
@@ -2327,40 +2011,36 @@ export class OptimisticBackend {
      *  deliver the coalesced result (`serverBatchEnd`). This is the engine's only sync-moving
      *  boundary — `onProgress` releases and `unregisterQuery`'s GC both go through here so head
      *  and sync never diverge (the §1.2 invariant; CRIT#2). */
-    runReconcileCycle(sourceKey, serverDeltas) {
-        // `sourceKey` names the authority these `deltas` confirm — `"daemon"` on the live daemon path (and
-        // the GC path), a `room:doc:X` string on a per-source release (E-iii). It selects which physical
-        // source the wasm engine's rewind folds the delta into (`Db::serverBatchBegin`). The E-iii-b/c
-        // per-source rewind + intersecting-pending re-invoke filter ride the same seam later.
-        this.local.serverBatchBegin(sourceKey, serverDeltas.map(toServerOp));
-        // The aggregate overlay (§4) is DAEMON-tracked: its `__agg_*` tables are server-authoritative
-        // synthetic tables that only the daemon feed drives. A room cycle must not wipe or rebuild it
-        // (that would double-count / lose daemon agg state), so gate every overlay interaction — reset,
-        // observe, and reconcileAggHead — on the daemon cycle. Single-domain: always daemon ⇒ unchanged.
-        const daemonCycle = sourceKey === "daemon";
-        if (daemonCycle) {
-            // The rewind cleared every optimistic write — incl. prior `__agg` edits — so head is now the
-            // server baseline. Rebuild the optimistic agg delta from scratch off the re-invoked
-            // (confirm-filtered) pending set, so a just-confirmed mutation's delta vanishes exactly as its
-            // server count is absorbed (§5 watermark — no double count).
-            this.overlay.reset();
-        }
+    runReconcileCycle(_sourceKey, serverDeltas) {
+        // `_sourceKey` names the authority these `deltas` confirm — `"daemon"` on the live daemon
+        // path (and the GC path), a `room:doc:X` string on a room release, whose deltas already carry
+        // the room's ENGINE table names (the gate's rename/filter). Kept for call-site readability
+        // and tracing only: the engine itself is source-agnostic (302: one authority per table) — its
+        // rewind covers EVERY tracked table and every pending mutation re-invokes below regardless of
+        // which channel released, so NOTHING in this cycle may branch on it.
+        this.local.serverBatchBegin(serverDeltas.map(toServerOp));
+        // The rewind covers EVERY tracked table (302: the engine is source-agnostic — there is no
+        // per-source rewind) — including the `__agg_*` head rows — whichever channel released. So the
+        // optimistic agg delta rebuilds on EVERY cycle, room or daemon: reset here, re-observe from
+        // the re-invoked pending set below, re-apply onto the rewound heads at the end. Gating any of
+        // the three on a daemon-only cycle (the pre-302 per-source-rewind contract) would let a room
+        // release wipe the optimistic `__agg` edits and skip the rebuild — every count() view snaps
+        // back to the server base until the next daemon release. The delta stays sound across
+        // domains: `reconcileAggHead` recomputes each head as the absolute `server_base ⊕ delta`,
+        // and the server base (`this.sync`) only moves on daemon releases.
+        this.overlay.reset();
         // Sort ALL pending into SEND order (the client-global `seq` ascending, then unflushed folds
         // last by creation order — the deterministic §4.1 slot; the comparator is explicit, NOT
-        // `(seq ?? ∞) - (seq ?? ∞)` which is `∞ - ∞ = NaN` and corrupts V8's sort), THEN FILTER to the
-        // writers of THIS source (§5.3): a per-source rewind un-applied ONLY that source's staged
-        // writes, so ONLY those must re-invoke — the others' predictions are intact on their un-rewound
-        // trees. The key MUST be `seq`, never `mid`: mids are per-domain (§7.1) so mids from different
-        // domains are incomparable — a mid-sort would replay a room mid 1 before a daemon mid 5 that
-        // was sent FIRST, letting a read-dependent mutator re-predict from a base it never saw
-        // (confirmation order is per-domain; replay order is client-global). FILTERING the
-        // globally-ordered array preserves the relative send order among the subset (the 200 §4.1
-        // invariant); NEVER re-sort the subset. Single-domain: every entry has
-        // `touchedSources = {"daemon"}` and seq order == mid order (except H-v deopt re-enqueues,
-        // which keep their ORIGINAL seq under a later daemon mid — deliberately, so this very sort
-        // replays them at their original overlay position) ⇒ byte-identical to before.
-        const order = [...this.pendingMutations]
-            .sort((a, b) => {
+        // `(seq ?? ∞) - (seq ?? ∞)` which is `∞ - ∞ = NaN` and corrupts V8's sort). The key MUST be
+        // `seq`, never `mid`: mids are per-domain (§7.1) so mids from different domains are
+        // incomparable — a mid-sort would replay a room mid 1 before a daemon mid 5 that was sent
+        // FIRST, letting a read-dependent mutator re-predict from a base it never saw (confirmation
+        // order is per-domain; replay order is client-global). EVERY entry re-invokes — the engine's
+        // rewind covers every tracked table (302: there is no per-source rewind), so every entry's
+        // staged writes were just un-applied, whichever channel released. Single-domain: seq order ==
+        // mid order (except H-v deopt re-enqueues, which keep their ORIGINAL seq under a later daemon
+        // mid — deliberately, so this very sort replays them at their original overlay position).
+        const order = [...this.pendingMutations].sort((a, b) => {
             if (a.seq === null && b.seq === null)
                 return 0; // both unflushed → stable creation order
             if (a.seq === null)
@@ -2368,20 +2048,19 @@ export class OptimisticBackend {
             if (b.seq === null)
                 return -1;
             return a.seq - b.seq;
-        })
-            .filter((p) => p.touchedSources.has(sourceKey));
+        });
         const dropped = new Set();
         try {
             for (const p of order) {
                 // NO `readLog` here — recording is armed only on the initial `invoke` (§3.2 #2 note on
                 // `PendingMutation.reads`); a re-invocation's write-set still needs fresh capture (below).
+                // The staging map follows the entry's CURRENT domain — a deopt-flipped or re-routed entry
+                // re-stages onto its new domain's tables here.
                 const writes = new Map();
                 const ops = [];
-                const stagedKeys = [];
-                let sources = [];
                 try {
-                    sources = this.local.writeWith((tx) => {
-                        this.runMutator(this.registry[p.name], trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, undefined, stagedKeys), p.args);
+                    this.local.writeWith((tx) => {
+                        this.runMutator(this.registry[p.name], trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, undefined, this.stagingMap(p.domain)), p.args);
                     });
                 }
                 catch {
@@ -2394,31 +2073,23 @@ export class OptimisticBackend {
                     dropped.add(p);
                     continue;
                 }
-                // The re-invocation stuck — fold its child ops into the rebuilt optimistic agg delta (daemon
-                // cycle only — a room cycle leaves the daemon-tracked overlay untouched).
-                if (daemonCycle)
-                    for (const op of ops)
-                        this.overlay.observe(op);
+                // The re-invocation stuck — fold its child ops into the rebuilt optimistic agg delta.
+                for (const op of ops)
+                    this.overlay.observe(op);
                 // The pending footprint is the UNION across invocations: a re-run that no-ops (touched =
                 // {}) must NOT shrink it, else a still-pending mutation reports not-pending and its
-                // pending-axis clear fires early (§7.2). `writes`/the source axes mirror this: merge, never
-                // replace. (A re-invocation may route differently, e.g. onto a source the room feed now
-                // holds — union so the filter still catches it on either source's next cycle.)
+                // pending-axis clear fires early (§7.2). `writes` mirrors this: merge, never replace.
                 for (const t of writes.keys())
                     p.touched.add(t);
                 mergeWriteSet(p.writes, writes);
-                for (const s of sources)
-                    p.touchedSources.add(s);
-                mergeWriteSources(p.writeSources, stagedKeys, sources);
             }
             // Preserve creation order in the live array (the unflushed-fold sort tiebreak depends on it).
             if (dropped.size)
                 this.pendingMutations = this.pendingMutations.filter((p) => !dropped.has(p));
             // Re-apply the optimistic agg delta onto the (rewound) `__agg` head rows — INSIDE the open
             // cycle, so the writes buffer and coalesce into the one per-query delivery `serverBatchEnd`
-            // makes (and never escape as a separate batch). Daemon cycle only (see above).
-            if (daemonCycle)
-                this.reconcileAggHead();
+            // makes (and never escape as a separate batch). Every cycle (see the reset above).
+            this.reconcileAggHead();
         }
         finally {
             this.local.serverBatchEnd(); // ALWAYS close the cycle — ONE delivery per affected query.
@@ -2435,10 +2106,6 @@ export class OptimisticBackend {
     resetGate(gate) {
         gate.buffer = [];
         gate.appliedCv = 0;
-        // The §301 upstream-absorption advert dies with the incarnation that made it — the fresh
-        // one re-advertises (direction-B pins conservatively hold until it does).
-        delete gate.upstreamBoot;
-        delete gate.upstreamCv;
     }
     /** The §8.5 escape: ONE gate's buffer outgrew its cap (a pinned `cvMin` under churn on that
      *  channel). Drop everything it buffered and re-register every query on that source — the fresh
@@ -2472,8 +2139,10 @@ export class OptimisticBackend {
         this.setResultType(qid, this.hydrated.has(qid) ? "complete" : "unknown");
     }
     /** A remote sub's first snapshot landed: mark it (and every local view it feeds) hydrated, then
-     *  lift those views out of `unknown` (loading). Idempotent — a re-hydrate snapshot re-marks
-     *  harmlessly; a source qid with no sub (the lmid system query) is a no-op. */
+     *  lift those views out of `unknown` (loading). A ROOM sub's hydration additionally queues the
+     *  302 §4.1 swap-in — performed at the applyRelease TAIL ({@link processSwapIns}), once the
+     *  reconcile has folded this snapshot into the room tables. Idempotent — a re-hydrate snapshot
+     *  re-marks harmlessly; a source qid with no sub (the lmid system query) is a no-op. */
     markSubHydrated(sourceQid) {
         const key = this.sourceToRemote.get(sourceQid);
         if (!key)
@@ -2482,6 +2151,8 @@ export class OptimisticBackend {
         if (!sub || sub.hydrated)
             return;
         sub.hydrated = true;
+        if (sub.channel !== "daemon" && !this.systemQids.has(sub.sourceQid))
+            this.pendingSwapIns.add(sub);
         for (const localQid of sub.localQids.keys()) {
             this.hydrated.add(localQid);
             this.recomputeResultType(localQid);
@@ -2512,11 +2183,32 @@ export class OptimisticBackend {
             // A late-joiner to an already-hydrated sub is immediately hydrated; otherwise this view now
             // awaits the sub's first snapshot (so a split-path local view registered `complete` flips to
             // `unknown` here). Then recompute its lifecycle.
-            if (sub.hydrated)
+            if (sub.hydrated) {
                 this.hydrated.add(localQueryId);
-            else
+                // 302 §4.1 LATE JOIN: a ROOM sub's one-shot swap queue ({@link markSubHydrated}) fired at
+                // its first released snapshot — long gone by now — so a view attaching afterwards must
+                // swap onto the room's namespaced tables HERE, or its engine query stays registered on
+                // the plain daemon tables the room channel never feeds (empty/stale, reported complete,
+                // diverging from its already-swapped siblings forever). The room tables already hold the
+                // released state (hydrated ⇒ folded), so swapping immediately is the ordinary
+                // after-the-data order; processSwapIns skips already-swapped siblings, and
+                // pendingSwapIns is empty outside a release, so exactly this sub's un-swapped views move.
+                if (sub.channel !== "daemon" && !this.systemQids.has(sub.sourceQid)) {
+                    this.pendingSwapIns.add(sub);
+                    this.processSwapIns();
+                }
+                // FORCE the notify past setResultType's dedup: the labeled split registers the local
+                // half `complete`, then flips the STORE view to `unknown` for the lease window WITHOUT
+                // touching our record — so a complete→complete recompute here would swallow the event
+                // and strand the late-joining view `unknown` forever. Redundant notifies are idempotent
+                // Store-side; a swallowed transition is not recoverable.
+                this.resultTypes.set(localQueryId, "complete");
+                this.resultTypeHandler(localQueryId, "complete");
+            }
+            else {
                 this.hydrated.delete(localQueryId);
-            this.recomputeResultType(localQueryId);
+                this.recomputeResultType(localQueryId);
+            }
         }
         this.localToRemote.set(retainQid, key);
         this.remoteRetainToLocal.set(retainQid, localQueryId);
@@ -2640,109 +2332,54 @@ function mergeWriteSet(dest, src) {
             d.set(pkKey, rec);
     }
 }
-/** The key a per-pk write source is stored under in {@link PendingMutation.writeSources}: `table`
- *  + NUL + the pk-key (`stableJson(pk)`). NUL appears in neither a table name nor `stableJson`
- *  output, so it is an unambiguous separator — the same key the confirm-drop hold-back reconstructs
- *  from `(table, pkKey)` while iterating `writes`. */
-function writeSourceKey(table, pkKey) {
-    return `${table}\u0000${pkKey}`;
-}
-/** Zip the staged-order per-write source keys (`stagedKeys`, from `trackingTx`) with the staged-order
- *  `sources[]` (`commitTracked`) into `dest`, last-write-per-key winning (§5.3). Never shrinks `dest`
- *  — a rebase re-invocation MERGES its fresh routing in, mirroring {@link mergeWriteSet}. The two
- *  arrays align 1:1: `trackingTx` pushes exactly one key per staged change, and `commitTracked`
- *  returns one source per staged change, both in staged order. */
-function mergeWriteSources(dest, stagedKeys, sources) {
-    const n = Math.min(stagedKeys.length, sources.length);
-    for (let i = 0; i < n; i++)
-        dest.set(stagedKeys[i], sources[i]);
-}
-// --- the §3 router's pure helpers (H-iii) --------------------------------------------
-/** STRICT cell identity for the join-key no-change rule (§3 write rule #3): `===`, nothing more —
- *  no coercion, no deep equality (a non-primitive join-key cell compares by reference and thus
- *  conservatively fails), `NaN !== NaN` conservatively fails. Failing closed here only costs a
- *  daemon route. */
-function identicalCell(a, b) {
-    return a === b;
+// --- the 302 room-table helpers -------------------------------------------------------
+/** The namespaced ENGINE table backing wire `table` for room `sourceKey` (302 §2: `room_deck` ≠
+ *  `deck` — one authority per table). `@` appears in no schema table name — ENFORCED by
+ *  `createSchema`/`extendSchema`'s addTableMeta ban (packages/client/src/schema.ts), so the name
+ *  cannot collide with a real table. */
+export function roomEngineTable(table, sourceKey) {
+    return `${table}@${sourceKey}`;
 }
-/** Whether `cond` is decidable from the KEY ALONE: every column it references — collected from
- *  BOTH operand positions (under-counting could over-claim decidability; over-counting only fails
- *  closed — the H-iv-a discipline) — is a pk column. A `correlatedSubquery` is never key-local. */
-// Exported for test/predicate_agreement.test.ts — the TS corner of the cross-evaluator
-// agreement corpus (rust/rindle-room-core/tests/fixtures/predicate-agreement.json). NOT part of
-// the package surface (index.ts curates exports); the corpus is the drift tripwire that keeps
-// this evaluator honest against the engine + room-gate pair it shares no code with.
-export function keyDecidable(cond, pkCols) {
-    switch (cond.type) {
-        case "simple": {
-            if (cond.left.type === "column" && !pkCols.has(cond.left.name))
-                return false;
-            if (cond.right.type === "column" && !pkCols.has(cond.right.name))
-                return false;
-            return true;
-        }
-        case "and":
-        case "or":
-            return cond.conditions.every((c) => keyDecidable(c, pkCols));
-        case "correlatedSubquery":
-            return false;
+/** Rename a room gate's released deltas into the room's namespaced tables, DROPPING deltas for
+ *  wire tables outside the map (context / unknown — the daemon is their sole authority, 302 §6).
+ *  Identity (no copy) for a map-less gate — the daemon path is untouched. */
+function mapGateDeltas(gate, muts) {
+    const map = gate.tableMap;
+    if (map === undefined)
+        return muts;
+    const out = [];
+    for (const m of muts) {
+        const engineTable = map.get(m.table);
+        if (engineTable === undefined)
+            continue;
+        out.push({ ...m, table: engineTable });
     }
+    return out;
 }
-/** Evaluate a key-decidable `footprintWhere` on a read's pk cells — H-iii's ONE client-side
- *  non-engine evaluator, DELIBERATELY MINIMAL (the TS evaluation caveat on the router block
- *  comment): `simple` `=`/`!=` between a pk COLUMN and a same-primitive-type NON-NULL literal,
- *  composed under and/or. The empty AND — the compiler's vacuous-true emission for an exact
- *  unconstrained footprint root — evaluates `true` (load-bearing: whole-table footprints keep
- *  provable reads); the empty OR is vacuous-false. Returns `undefined` = NOT EVALUABLE for
- *  anything else (other ops, null on either side, cross-type comparisons, column-vs-column,
- *  literal-vs-literal, non-primitive cells, correlated subqueries) — the caller fails to the
- *  daemon. A non-evaluable node anywhere poisons the whole tree (no short-circuit past it):
- *  partial evaluation could otherwise claim a verdict the engine's semantics might contradict. */
-// Exported for test/predicate_agreement.test.ts (see keyDecidable's note above).
-export function evalFootprintOnPk(cond, pkCells) {
-    switch (cond.type) {
-        case "simple": {
-            if (cond.op !== "=" && cond.op !== "!=")
-                return undefined;
-            const col = cond.left.type === "column" ? cond.left : cond.right.type === "column" ? cond.right : undefined;
-            const lit = cond.left.type === "literal" ? cond.left : cond.right.type === "literal" ? cond.right : undefined;
-            if (col === undefined || lit === undefined)
-                return undefined; // column-vs-column / literal-vs-literal
-            if (!pkCells.has(col.name))
-                return undefined; // not a pk column (keyDecidable pre-screens)
-            const cell = pkCells.get(col.name);
-            const value = lit.value;
-            if (cell === null || value === null)
-                return undefined; // no null semantics client-side
-            if (typeof cell !== typeof value)
-                return undefined; // no cross-type comparison semantics
-            if (typeof cell !== "string" && typeof cell !== "number" && typeof cell !== "boolean")
-                return undefined;
-            return cond.op === "=" ? cell === value : cell !== value;
-        }
-        case "and": {
-            let out = true;
-            for (const c of cond.conditions) {
-                const v = evalFootprintOnPk(c, pkCells);
-                if (v === undefined)
-                    return undefined;
-                out = out && v;
-            }
-            return out;
-        }
-        case "or": {
-            let out = false;
-            for (const c of cond.conditions) {
-                const v = evalFootprintOnPk(c, pkCells);
-                if (v === undefined)
-                    return undefined;
-                out = out || v;
-            }
-            return out;
-        }
-        case "correlatedSubquery":
-            return undefined;
-    }
+/** Rename every TABLE reference in a query AST through `map` (302 §2 point 3 — the room-homed
+ *  view's rewrite): the root `table`, every `related` subquery, every `correlatedSubquery`
+ *  (EXISTS) condition — walking the KNOWN wire-AST shape, never a blind key scan: `start.row` is
+ *  keyed by COLUMN name (a schema column literally named `table` must keep its bound value), and
+ *  the same goes for any future column-keyed record. Tables absent from the map keep their name —
+ *  that is the client-side join across kinds (a room table joined to daemon-owned context,
+ *  201-style). Structural clone; the input AST is never mutated. */
+export function remapAstTables(ast, map) {
+    const walkCond = (c) => {
+        if (c.type === "and" || c.type === "or")
+            return { ...c, conditions: c.conditions.map(walkCond) };
+        if (c.type === "correlatedSubquery")
+            return { ...c, related: walkSub(c.related) };
+        return c; // "simple" — column refs and literals carry no table reference
+    };
+    const walkSub = (s) => ({ ...s, subquery: walk(s.subquery) });
+    const walk = (a) => ({
+        ...a,
+        table: map.get(a.table) ?? a.table,
+        ...(a.where !== undefined ? { where: walkCond(a.where) } : {}),
+        ...(a.having !== undefined ? { having: walkCond(a.having) } : {}),
+        ...(a.related !== undefined ? { related: a.related.map(walkSub) } : {}),
+    });
+    return walk(ast);
 }
 /** Wrap the raw wasm txn as the client `MutationTx`, capturing a pk-granular write-set as it
  *  applies (`writes`, a {@link WriteSet} — table → pk-key → last-write-wins image, §3.2 #1);
@@ -2780,17 +2417,22 @@ function applyOpToTx(tx, op) {
             return tx.delete(op.table, op.pk);
     }
 }
-function trackingTx(tx, writes, specs, localTables, onOp, trapReads = false, readLog, stagedKeys, 
-/** Per-read provenance probe (H-ii §3.2 #3): called once per RECORDED present read with the
- *  full-width row the read observed; meaningful only alongside `readLog` (never consulted when
- *  recording is off — the fold and replay paths pass neither). */
-provenance) {
+function trackingTx(tx, writes, specs, localTables, onOp, trapReads = false, readLog, 
+/** The 302 staging map for a room-DECLARED mutation: wire table → the room's namespaced engine
+ *  table for the tables the room owns; identity for everything else. Every raw engine access —
+ *  reads and writes — goes through it, so a room mutator reads/writes the room's own state
+ *  (its optimistic effects land where the room-homed views look) while its envelope still
+ *  ships the wire names. Absent (or a non-owned table) ⇒ the plain table, verbatim. */
+stage) {
     const spec = (table) => {
         const s = specs[table];
         if (!s)
             throw new Error(`unknown table ${JSON.stringify(table)} — tables: ${Object.keys(specs).join(", ")}`);
         return s;
     };
+    /** The ENGINE table a wire-named access lands on (302 §2). Schema/column validation always
+     *  runs on the WIRE name (the namespaced twin shares the spec). */
+    const staged = (table) => stage?.get(table) ?? table;
     // M1 (`201-LOCAL-ONLY-TABLES-DESIGN.md` §6): a replayable mutator is a pure function of
     // (synced base + args) — it neither READS nor WRITES a local-only table. The server runs the
     // same mutator from `args` alone and cannot see local tables, so any dependence diverges the
@@ -2825,18 +2467,16 @@ provenance) {
     // this invocation — an add-then-edit (or edit-then-edit) of the same pk collapses to its final
     // image, matching the engine head's own semantics for that pk. The record is replaced with
     // exactly the arguments given: the CALLERS (`edit`/`remove` below, consulting `prior`) decide
-    // the pre-image per the H-ii coalescing matrix on {@link WriteRecord}.
-    const recordWrite = (table, pk, row, oldRow) => {
-        let byPk = writes.get(table);
+    // the pre-image per the H-ii coalescing matrix on {@link WriteRecord}. Keyed by the STAGED
+    // (engine) table name, so the pending axis and the write-set match what the engine holds.
+    const recordWrite = (engineTable, pk, row, oldRow) => {
+        let byPk = writes.get(engineTable);
         if (!byPk)
-            writes.set(table, (byPk = new Map()));
+            writes.set(engineTable, (byPk = new Map()));
         const pkKey = stableJson(pk);
         // Defensive copies: the wasm binding's returned arrays are not contractually immutable/unique,
         // so a captured record must not alias a cell array the engine could later reuse or mutate.
-        byPk.set(pkKey, { table, pk: [...pk], row: row ? [...row] : undefined, ...(oldRow ? { oldRow: [...oldRow] } : {}) });
-        // Staged-order key trace (§5.3): pushed once per staged change, so it zips 1:1 with the staged
-        // order of `commitTracked`'s `sources[]` — letting the caller learn each write's routed source.
-        stagedKeys?.push(writeSourceKey(table, pkKey));
+        byPk.set(pkKey, { table: engineTable, pk: [...pk], row: row ? [...row] : undefined, ...(oldRow ? { oldRow: [...oldRow] } : {}) });
     };
     // A full insert row: each cell is `obj[c]`, or `null` for an omitted nullable column (design 206
     // §6.2); a `json` object is stringified for the engine (`toCell`). Non-nullable columns are
@@ -2864,22 +2504,17 @@ provenance) {
     // trapped path (where `readLog` is never armed) records nothing, exactly as before.
     const rawGet = (table, pk) => {
         assertNotLocal(table, "read");
-        return tx.get(table, pk);
+        return tx.get(staged(table), pk);
     };
     // Push one {@link ReadRecord} when recording is armed (§3.2 #2/#3): outcome from `row`'s
-    // presence, per-read provenance probed with the observed FULL-WIDTH row — present reads only
-    // (an absent read has no row to probe with, and records no source; see {@link ReadRecord}).
-    // The `source` key is OMITTED (not set to undefined) when there is no answer, so a
-    // single-domain record is byte-identical to Slice B's.
+    // presence. Pure capture for inspection.
     const recordRead = (table, pk, row) => {
         if (!readLog)
             return;
-        const source = row === undefined ? undefined : provenance?.(table, row);
         readLog.reads.push({
             table,
             pk: [...pk],
             outcome: row === undefined ? "absent" : "present",
-            ...(source !== undefined ? { source } : {}),
         });
     };
     // The PUBLIC positional read (§3.2 #2) — and, since H-ii, the keyed writers' pre-existence
@@ -2899,50 +2534,55 @@ provenance) {
         return cells ? toKeyed(table, cells) : undefined;
     };
     // The pk's existing record from THIS invocation, if any — the coalescing-matrix input for
-    // `edit`/`remove` below (see {@link WriteRecord}).
-    const prior = (table, pk) => writes.get(table)?.get(stableJson(pk));
+    // `edit`/`remove` below (see {@link WriteRecord}). Keyed by the STAGED name like the records.
+    const prior = (table, pk) => writes.get(staged(table))?.get(stableJson(pk));
     const add = (table, row) => {
         assertNotLocal(table, "write");
-        recordWrite(table, pkFromCells(table, row), row);
+        const t = staged(table);
+        recordWrite(t, pkFromCells(table, row), row);
+        // ChildOps carry the WIRE name (unlike the write-set): the agg overlay's defs are keyed by
+        // the ORIGINAL AST's child tables (`collectAggDefs`), and the `__agg_*` heads it feeds are
+        // shared by plain and swapped views alike — a staged name would silently miss the dispatch
+        // and the optimistic count would lag every room-declared write until its echo.
         onOp?.({ table, kind: "add", row });
-        tx.add(table, row);
+        tx.add(t, row);
     };
     const remove = (table, row) => {
         assertNotLocal(table, "write");
+        const t = staged(table);
         const pk = pkFromCells(table, row);
-        // The remove PRE-IMAGE (G-iii, §7.3 tombstone; the H-ii matrix on {@link WriteRecord}):
-        // remove-after-edit/-remove keeps the ORIGINAL captured pre-image (the txn-entry base — the
-        // net effect is a remove of the row the external world last knew, never the edited transient).
-        // Otherwise (first touch, or remove-after-add) the truthful full-width row is the txn-visible
-        // one — `tx.get` read BEFORE the remove stages (read-your-writes: an add of this pk earlier in
-        // the SAME invocation shows through). Captured NOW so Slice H's writable-predicate evaluation
-        // over it needs no migration. Falls back to the caller's asserted `row` when the pk is not
+        // The remove PRE-IMAGE (the H-ii matrix on {@link WriteRecord}): remove-after-edit/-remove
+        // keeps the ORIGINAL captured pre-image (the txn-entry base — the net effect is a remove of
+        // the row the external world last knew, never the edited transient). Otherwise (first touch,
+        // or remove-after-add) the truthful full-width row is the txn-visible one — `tx.get` read
+        // BEFORE the remove stages (read-your-writes: an add of this pk earlier in the SAME
+        // invocation shows through). Falls back to the caller's asserted `row` when the pk is not
         // resident (a raw remove of an absent row) — a captured remove thus always carries a
-        // full-width pre-image (the engine width-checks `holdBackAbsent`).
-        const oldRow = prior(table, pk)?.oldRow ?? tx.get(table, pk) ?? row;
-        recordWrite(table, pk, undefined, oldRow);
-        onOp?.({ table, kind: "remove", row });
-        tx.remove(table, row);
+        // full-width pre-image.
+        const oldRow = prior(table, pk)?.oldRow ?? tx.get(t, pk) ?? row;
+        recordWrite(t, pk, undefined, oldRow);
+        onOp?.({ table, kind: "remove", row }); // wire name — see `add`
+        tx.remove(t, row);
     };
     const edit = (table, oldRow, newRow) => {
         assertNotLocal(table, "write");
+        const t = staged(table);
         const pk = pkFromCells(table, newRow);
-        // The edit PRE-IMAGE (H-ii; the matrix on {@link WriteRecord}) — H-iii's join-key no-change
-        // input, and the row the engine routes the Edit by (H-i). First touch: the txn-visible row
-        // read BEFORE staging, falling back to the caller's asserted `oldRow` when the pk is not
+        // The edit PRE-IMAGE (the H-ii matrix on {@link WriteRecord}). First touch: the txn-visible
+        // row read BEFORE staging, falling back to the caller's asserted `oldRow` when the pk is not
         // resident (covers the pk-MOVING raw edit — the record is keyed by the NEW pk; the pre-image
         // carries the OLD row). Edit-after-edit: keep the FIRST pre-image (the txn-entry base).
         // Edit-after-add / edit-after-remove: the record collapses to a (re-)insert — NO pre-image
         // (the pk did not pre-exist this invocation's base).
         const p = prior(table, pk);
         const pre = p === undefined
-            ? (tx.get(table, pk) ?? oldRow)
+            ? (tx.get(t, pk) ?? oldRow)
             : p.row !== undefined && p.oldRow !== undefined
                 ? p.oldRow
                 : undefined;
-        recordWrite(table, pk, newRow, pre);
-        onOp?.({ table, kind: "edit", row: newRow, old: oldRow });
-        tx.edit(table, oldRow, newRow);
+        recordWrite(t, pk, newRow, pre);
+        onOp?.({ table, kind: "edit", row: newRow, old: oldRow }); // wire name — see `add`
+        tx.edit(t, oldRow, newRow);
     };
     // The folded read trap (§5): a mutator that reads to compute its write is refused. `() => never`
     // is assignable to the wider read signatures (extra args ignored, `never` widens to the result).
@@ -2959,7 +2599,9 @@ provenance) {
         for (const t of collectTables(ast))
             assertNotLocal(t, "read");
         readLog?.queries.push(ast);
-        return tx.query(ast);
+        // A room-declared mutator's one-shot query reads the room's own staged state for the tables
+        // the room owns (the same staging rule as the point reads above).
+        return tx.query(stage !== undefined && stage.size > 0 ? remapAstTables(ast, stage) : ast);
     };
     return {
         get: trapReads ? trapped : getImpl,