@rindle/optimistic 0.5.0 → 0.6.3

package/src/backend.ts

@@ -60,6 +60,7 @@ import type {
   ColsMap,
   ColType,
   Condition,
+  CorrelatedSubquery,
   IsoTx,
   KeyedRow,
   Mutation,
@@ -82,7 +83,7 @@ import type {
   WireValue,
 } from "@rindle/client";
 import { aggTableSchemas, NormalizedSync, rewriteAggregates, type ColCounts, type PkCols } from "@rindle/normalized";
-import { WasmBackend, type ServerDeltaOp, type WasmWriteTxn, type WritableDescriptor } from "@rindle/wasm";
+import { WasmBackend, type ServerDeltaOp, type WasmWriteTxn } from "@rindle/wasm";
 
 import { AggOverlay, type ChildOp, collectAggDefs } from "./agg-overlay.ts";
 import {
@@ -170,16 +171,13 @@ const LMID_QID: QueryId = 0;
  *  the post-write image (positional wire cells, schema column order); `undefined` for a `remove` —
  *  no row survives it, and `row === undefined` stays the remove marker.
  *
- *  `oldRow` is the PRE-IMAGE, captured for a `remove` (G-iii, §7.3 tombstone) AND — since H-ii —
- *  an `edit` (it feeds H-iii's join-key no-change rule, old vs new join-key cells, and mirrors the
- *  engine, which routes an Edit by its OLD row — the H-i handoff): the full-width row read via
- *  `tx.get` immediately BEFORE the write staged — read-your-writes, so a write to the same pk
- *  earlier in the SAME invocation shows through — falling back to the caller's asserted old row
- *  when the pk is not txn-visible (a raw remove/edit of an absent row; incl. the pk-MOVING raw
- *  edit, whose record is keyed by the NEW pk yet whose pre-image is the caller's OLD row — the row
- *  H-i's `provenanceOf` routes by). A captured remove/edit thus always carries a full-width
- *  pre-image (the engine width-checks `holdBackAbsent`; Slice H evaluates writable predicates on
- *  it) — with ONE exception: a record that collapses to a (re-)insert has none, see the matrix.
+ *  `oldRow` is the PRE-IMAGE, captured for a `remove` AND an `edit` (H-ii): the full-width row
+ *  read via `tx.get` immediately BEFORE the write staged — read-your-writes, so a write to the
+ *  same pk earlier in the SAME invocation shows through — falling back to the caller's asserted
+ *  old row when the pk is not txn-visible (a raw remove/edit of an absent row; incl. the
+ *  pk-MOVING raw edit, whose record is keyed by the NEW pk yet whose pre-image is the caller's
+ *  OLD row). A captured remove/edit thus always carries a full-width pre-image — with ONE
+ *  exception: a record that collapses to a (re-)insert has none, see the matrix.
  *
  *  Coalescing within one invocation is last-write-wins per pk on `row` (the final image matches
  *  the engine head's own semantics for that pk) with `oldRow` pinned to the TXN-ENTRY BASE — the
@@ -227,18 +225,6 @@ export interface ReadRecord {
   table: string;
   pk: WireValue[];
   outcome: ReadOutcome;
-  /** Per-read provenance (H-ii, §3.2 #3): the engine's `provenanceOf` answer AT THE MOMENT OF THE
-   *  READ — which source ("daemon" / a room key) served the row the mutator saw. Live pre-commit
-   *  state: an open txn's staged writes are not consulted (H-i), so a PRESENT read of a pk this
-   *  txn itself created reports `undefined` — recorded honestly, key omitted (the router treats
-   *  self-reads via write-set membership, not provenance). ABSENT reads carry no source (the
-   *  mutator saw no row; there is no full-width row to probe with — a pk this txn staged-removed
-   *  thus also records `undefined`, again a write-set-membership case for the router). Probed only
-   *  on a PROMOTED table ({@link promotedTables}): a never-promoted (Collapsed) table is
-   *  daemon-owned by construction, so a pure single-domain app pays zero wasm calls per read and
-   *  `undefined` is still correct (everything is daemon-owned). One probe call per recorded
-   *  present read, at read time. */
-  source?: string;
 }
 
 /** The read-log captured over ONE mutator invocation when recording is armed (RINDLE-REALTIME-
@@ -246,106 +232,14 @@ export interface ReadRecord {
  *  and, since H-ii, the keyed writers' internal pre-existence probes) plus every resolved query AST
  *  (`queries`, from `tx.query`). A SIBLING of the folded read TRAP (`FoldReadError` below) — the
  *  trap arms on the folded path and throws before any read completes (recording never runs there);
- *  recording arms on the ordinary (non-folded) prediction run and never throws. Pure capture: which
- *  row/predicate a read is actually PROVEN covered by (§3.1's table) is a later slice's job. */
+ *  recording arms on the ordinary (non-folded) prediction run and never throws. Pure capture for
+ *  devtools/inspection (the §3 routing derivation it once fed was removed by
+ *  302-ROOM-STORE-SEPARATION-DESIGN.md §5 — mutators DECLARE their domain now). */
 export interface ReadLog {
   reads: ReadRecord[];
   queries: Ast[];
 }
 
-/** One promoted `(sourceKey, table)`'s client-held routing spec — THE per-table routing record the
- *  §3 prove-or-slow-path router reads (H-iii). Recorded by {@link OptimisticBackend.promoteRoomTable}
- *  in the same breath as the engine attach, from the lease's `RealtimeLeaseTableSpec` (the
- *  api-server's `RoomTableSpec`, one compiler with the boot wire).
- *
- *  - `writable`: whether the room may write this table AT ALL — `true` iff the registered engine
- *    {@link WritableDescriptor} is not `none` (a context/"followed" table is `none`; the daemon
- *    stays write-authoritative for it, §2.2). Rule #1 of the write proof.
- *  - `joinKeyCols`: the correlation columns the footprint binds on this table — the "room mutators
- *    never change join keys" input (an edit with a moved join-key cell would re-parent the row
- *    across the footprint's correlation and is refused room-routing). Deliberately client-side —
- *    they never cross the wasm {@link WritableDescriptor} ABI (the room GATE enforces them
- *    engine-side, H-iv).
- *  - `where`: the lease's row-local writable predicate (advisory here — the router evaluates the
- *    ENGINE's compiled copy via `writableMatches`, never this one; kept for introspection parity
- *    with the wire).
- *  - `footprintWhere`: the EXACT footprint-membership predicate (H-iv-b: root-node-only, lossless
- *    extraction; the vacuous-true `{type:"and",conditions:[]}` for an exact unconstrained root;
- *    ABSENT for child/correlated tables). The read proof's pk-membership test input — see
- *    {@link OptimisticBackend.deriveDomain}. */
-export interface RoomTableRouting {
-  writable: boolean;
-  joinKeyCols: string[];
-  where?: Condition;
-  footprintWhere?: Condition;
-}
-
-/** The per-table spec {@link OptimisticBackend.promoteRoomTable} receives beside the engine
- *  descriptor (H-iii spec plumbing) — the wire-facing half of {@link RoomTableRouting}
- *  (`writable` is derived from the descriptor's kind, never passed separately). */
-export interface RoomTableRoutingSpec {
-  joinKeyCols?: readonly string[];
-  where?: Condition;
-  footprintWhere?: Condition;
-}
-
-/** The §3 router's Q6 measurement hook ({@link OptimisticBackend.__inspectDomains}`().routing`):
- *  how often derivation succeeded (per derived room) and why it fell back to the daemon (per
- *  failure reason). `reasons` counts PER-CANDIDATE proof failures plus the terminal reasons
- *  (`no-candidates` / `tx-query` / `ambiguous`) — with multiple candidate rooms one derivation can
- *  bump several reason counters (one per failing candidate), and a candidate's failure is counted
- *  even when a sibling candidate ultimately proved. Explicit-policy pins bump NOTHING (the router
- *  never ran). */
-export interface RoutingInspect {
-  /** Successful DERIVED routes, per room key. */
-  derived: Record<string, number>;
-  /** Derivation failures, per {@link RoutingFailureReason}. */
-  reasons: Record<string, number>;
-}
-
-/** Why a §3 derivation (or one candidate's proof) fell to the daemon — the {@link RoutingInspect}
- *  counter keys. */
-export type RoutingFailureReason =
-  /** No connected room gate with a promoted table — the single-domain fast path. */
-  | "no-candidates"
-  /** The invocation ran `tx.query` — a declarative read is not room-provable client-side
-   *  (rindle-cover is native-only BY DESIGN), so the whole derivation fails unconditionally. */
-  | "tx-query"
-  /** Two or more candidate rooms both proved. Principled disambiguation is a §9.2 (multi-room
-   *  clients + budgets) NON-goal, deferred past Slice J; routing slow is always sound (the §3.3
-   *  gate is the contract). Reachable essentially only for zero-write mutations — real writes
-   *  can't be writable in two rooms (§2.2 exactly-one-writer per doc). */
-  | "ambiguous"
-  /** A write touched a table not promoted for the candidate, or promoted `writable: none`
-   *  (context) — the room may not write it at all. */
-  | "write-unwritable-table"
-  /** `writableMatches` refused the write's post-image (add/edit) or pre-image (remove). */
-  | "write-scope-miss"
-  /** An edit moved a join-key cell (old vs new differ on a `joinKeyCols` column). */
-  | "write-join-key-change"
-  /** The engine's provenance for the write's probe row names a DIFFERENT room. */
-  | "write-cross-room-provenance"
-  /** A recorded read was served by a DIFFERENT room. */
-  | "read-cross-room"
-  /** A read needed the pk-membership test but the table has no `footprintWhere` (child /
-   *  correlated / inexact extraction / never-promoted table). */
-  | "read-no-footprint-where"
-  /** `footprintWhere` references a non-pk column — not decidable from the key alone. */
-  | "read-not-key-decidable"
-  /** `footprintWhere` is key-decidable but outside the deliberately-minimal client evaluator
-   *  (an op other than `=`/`!=`, a null/type-mixed comparison, column-vs-column, …). */
-  | "read-not-evaluable"
-  /** `footprintWhere` evaluated FALSE on the read's pk — the room provably never holds it. */
-  | "read-outside-footprint"
-  /** NOT a derivation failure (H-v): a routed mutation came back `mutationOutcome
-   *  {kind:"deopt"}` — the room GATE refused it at commit and the client re-enqueued it onto the
-   *  daemon. Counted per processed deopt frame so Q6's picture is complete: derived-and-deopted
-   *  routes are visible beside derived successes (a rising `deopt` count against a rising
-   *  `derived` count means the client proof and the gate disagree — a compiler/evaluator skew
-   *  worth investigating; each one costs a room round-trip + a burnt room mid, never
-   *  correctness). */
-  | "deopt";
-
 interface PendingMutation {
   /** The wire mutation id. A FOLDED entry carries `null` until its window flushes — the `mid`
    *  is dealt from `nextMid` in SEND order, never reserved at invoke, so the wire sequence stays
@@ -379,21 +273,9 @@ interface PendingMutation {
   /** The pk-granular write-set captured at this entry's LAST invocation (§3.2 #1). A rebase
    *  re-invocation MERGES its fresh write-set into this one ({@link mergeWriteSet}), mirroring the
    *  `touched` union: the key set only grows across re-invocations (a re-run that no-ops must not
-   *  shrink it, §7.2), each key's value is always the newest. */
+   *  shrink it, §7.2), each key's value is always the newest. Tables are ENGINE names: a
+   *  room-domain entry's writes on the room's own tables record the namespaced name (302 §2). */
   writes: WriteSet;
-  /** The physical SOURCES this mutator's writes staged onto (RINDLE-REALTIME-QUERY-ENABLEMENT-
-   *  DESIGN.md §5.3, from `commitTracked`) — `{"daemon"}` in single-domain. Drives the per-source
-   *  reconcile FILTER: `runReconcileCycle(sourceKey)` re-invokes an entry only if it wrote onto
-   *  `sourceKey` (its writes there were un-applied by that source's rewind; other-source writes are
-   *  intact). Union-merged across re-invocations, never shrunk (like `touched`). DISTINCT from
-   *  {@link domain} (which stream CONFIRMS it): a room-domain mutation whose write routed to the
-   *  daemon slice (a fresh pk) has `domain === "room:doc:X"` but `touchedSources ∋ "daemon"`. */
-  touchedSources: Set<string>;
-  /** Per staged (table, pk) → the source it routed onto ({@link writeSourceKey}), aligned from
-   *  `commitTracked`'s staged-order `sources[]` (last write to a pk wins). Read at the confirm-drop
-   *  to fire the §7.3 echo hold-back for a write whose source ≠ its confirming {@link domain}.
-   *  All `"daemon"` in single-domain (inert). Merged never-shrunk across re-invocations. */
-  writeSources: Map<string, string>;
   /** The read-log captured at this entry's LAST *recorded* invocation (§3.2 #2). Empty for a
    *  FOLDED entry (the trap, not recording, arms on that path — nothing is ever recorded there)
    *  and left as the ORIGINAL invoke's log across a rebase re-invocation: recording is armed only
@@ -492,14 +374,12 @@ interface SourceGate {
   /** Arrival counter behind {@link BufferedFrame.seq}, scoped to THIS gate's buffer. */
   nextSeq: number;
   appliedCv: number;
-  /** The channel's latest UPSTREAM-absorption advert (§301 direction B, a ROOM gate only): "I
-   *  have absorbed upstream daemon commits through cv `upstreamCv` of boot `upstreamBoot`" —
-   *  recorded verbatim from each {@link ProgressFrame} ({@link OptimisticBackend.onGateProgress})
-   *  so the drop pass that runs at that release's tail reads exactly this release's advert.
-   *  `undefined` until the shell advertises (an old shell never does — the §2.5 skew fallback);
-   *  cleared on a channel restart (the fresh incarnation re-advertises). */
-  upstreamBoot?: string;
-  upstreamCv?: number;
+  /** A ROOM gate's wire-table → engine-table map (302 §2 — one source per table): the channel's
+   *  released deltas rename into the room's own namespaced tables, and a wire table NOT in the
+   *  map (context the room still publishes, or an unknown table) is DROPPED — the daemon is the
+   *  sole authority for context, so its copy must never enter the store from a room channel
+   *  (302 §6). Absent on the daemon gate (its deltas apply verbatim). */
+  tableMap?: ReadonlyMap<string, string>;
 }
 
 /** One I-iv doorbell event ({@link OptimisticBackend.onScopeSessions}, §4.1): a release folded
@@ -513,21 +393,23 @@ export interface ScopeSessionsEvent {
   others: number;
 }
 
-/** One demoted room source's §4.2 ghost record (Slice I-v): the room slice stays FROZEN in the
- *  merge (wins-if-present — still supplying the visible rows, accepting nothing) until the
- *  daemon plane has provably absorbed the room's final flush. The drop condition is evaluated
- *  after every release ({@link OptimisticBackend.evaluateGhosts}):
+/** One demoted room source's §4.2 SWAP-BACK gate record (Slice I-v, re-expressed by 302 §4.2):
+ *  after a downgrade the room's namespaced tables keep backing their views — frozen at the room's
+ *  last state (the channel is disconnected) — until the daemon plane has provably absorbed the
+ *  room's final flush. Swapping the views back earlier would show the falling-back follower's
+ *  PRE-flush images (a visibly rolled-back document). The drop condition is evaluated after every
+ *  release ({@link OptimisticBackend.evaluateGhosts}):
  *
  *    `roomWatermarks[doc] ≥ finalFlushSeq`  (0 ⇒ trivially true — a never-flushed room)
  *    AND no pending mutation with `domain === sourceKey` remains (sent-pins-domain, §7.5 —
  *    room-domain entries retire ONLY through the outcome-resolved daemon-carried folds, I-iii).
- */
+ *
+ *  Both satisfied ⇒ {@link OptimisticBackend.dropGhost}: every room-swapped view re-registers on
+ *  its ORIGINAL (daemon-table) AST — value-equal under the fence, so visually a no-op — and the
+ *  room's namespaced tables unregister. */
 interface RoomGhost {
   doc: string;
   finalFlushSeq: number;
-  /** Every table promoted for the sourceKey at demote time — the {@link dropGhost} removal set
-   *  (and, while the ghost lives, its hold on the {@link promotedTables} record). */
-  tables: string[];
   /** Whether the ONE stuck-downgrade event already fired for this ghost. */
   stuckReported: boolean;
 }
@@ -543,41 +425,18 @@ export interface DowngradeStuckEvent {
   mids: number[];
 }
 
-/** One §301 echo-fence pin (`301-ECHO-FENCE-DESIGN.md` §2.1): the client-side registry entry for
- *  a parked engine hold-back, carrying the DELIVERY-fence inputs the engine deliberately does not
- *  know. Parked in the same breath as `holdBack`/`holdBackAbsent` at the §7.3 confirm-drop; keyed
- *  `${table}\0${sourceKey}\0${pkKey}` so a re-park of the same slice-pk overwrites (matching the
- *  engine's `held_back.insert`). The fence per direction (§1):
- *
- *   - **A** (`sourceKey === "daemon"`, a room-domain write staged on the daemon slice): drops
- *     when the DAEMON-CARRIED room ledger covers `mid` — {@link OptimisticBackend}'s
- *     `daemonCarriedLmid[domain] ≥ mid` (the I-ii co-commit puts the flush data in the same
- *     coherent release, §1.1).
- *   - **B** (a room `sourceKey`, `domain === "daemon"`): drops when the room gate advertises
- *     absorption at-or-past the parking daemon release — `(upstreamBoot, upstreamCv)` covers
- *     `(daemonBoot, daemonCv)` under the §2.4 boot rule.
- *   - a room-staged pin confirmed by ANOTHER room has no fence (out of today's two-tier
- *     topology); it drops only via the engine's state-match fallback. */
-interface EchoFencePin {
-  table: string;
-  /** The staged slice holding the engine pin — what to drop ON. */
+/** The 302 §6.1 context-coverage event ({@link OptimisticBackend.onRoomContextJoin}): a view
+ *  swapping onto room `sourceKey`'s namespaced tables still references `tables` the room does NOT
+ *  own — those refs keep reading the PLAIN daemon tables (the client-side join across kinds), and
+ *  the room's relayed copies of them are dropped by design (§6). Whether a daemon subscription
+ *  covers the joined rows is unknowable here, so the condition is surfaced ONCE per view: without
+ *  coverage the join renders silently empty for the whole room session. Fired at swap-in — a view
+ *  whose every referenced table is room-owned (every in-repo app today) never fires it. */
+export interface RoomContextJoinEvent {
   sourceKey: string;
-  /** The held row / pre-image (full-width; the pk derives from it) — what to drop AT. */
-  probeRow: WireValue[];
-  /** The confirming domain (direction A's ledger to watch). */
-  domain: string;
-  /** The confirmed wire mid (direction A's fence input). */
-  mid: number;
-  /** Direction B stamps (301 §1.2): the parking daemon release's coherence position + the
-   *  client-observed daemon boot it belongs to. Absent on direction A / the no-fence shape. */
-  daemonBoot?: string;
-  daemonCv?: number;
-  /** The slice's confirmed-baseline row at park — the §2.5 stuck-pin tripwire's "has the
-   *  baseline CHANGED VALUE since park" reference (that change is the suspicious state that
-   *  precedes every forever-pin). */
-  baselineAtPark?: WireValue[];
-  /** The tripwire's log-once latch. */
-  tripwired?: boolean;
+  name: string;
+  args: unknown;
+  tables: string[];
 }
 
 export interface OptimisticBackendOptions {
@@ -593,14 +452,13 @@ export interface OptimisticBackendOptions {
   /** Virtual-clock seam for the fold debounce timers (FOLDED-MUTATIONS-DESIGN §9). Defaults to
    *  real `setTimeout`/`clearTimeout`/`Date.now`; the fold oracle injects a deterministic clock. */
   clock?: FoldClock;
-  /** The explicit confirming-stream OVERRIDE (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §7.1 /
-   *  §3). Since H-iii the live default is the §3 prove-or-slow-path DERIVATION
-   *  ({@link OptimisticBackend.deriveDomain}): a configured policy returning a string pins that
-   *  domain VERBATIM — no proof runs (the test suites and the dual-source e2e pin by name);
-   *  returning `undefined` (or configuring no policy) derives the domain from the prediction run's
-   *  write/read capture against the connected room gates' routing table. With no room gate
-   *  connected the derivation short-circuits to `"daemon"` — every single-domain app is
-   *  byte-for-byte as before. */
+  /** The DECLARED confirming stream per mutation (302 §5: declared, not derived — there is no
+   *  routing proof). A policy returning a string pins that domain verbatim: the mutation stages
+   *  onto that room's namespaced tables and ships on its channel. Returning `undefined` (or
+   *  configuring no policy) means `"daemon"`. The client layer builds this from the app's declared
+   *  realtime mutators + the currently attached rooms; a misdeclaration fails SOFT (302 §5.1) —
+   *  the write lands on the other authority's tables and the view simply stops feeling instant
+   *  until the echo relays it. */
   domainPolicy?: (name: string, args: unknown) => string | undefined;
   /** A FINAL (authz/validation) mutation rejection's reason surface — the room plane's twin of the
    *  HTTP mutate route's `onRejected` (H-v; the H-iv-b `mutationOutcome {kind:"rejected"}` frame).
@@ -680,8 +538,8 @@ const REAL_CLOCK: FoldClock = {
 };
 
 /** The (shared, frozen-by-convention) empty map {@link OptimisticBackend.roomTablesFor} answers
- *  for a room with no promoted tables. */
-const EMPTY_ROUTING: ReadonlyMap<string, RoomTableRouting> = new Map();
+ *  for a room with no registered tables. */
+const EMPTY_ROOM_TABLES: ReadonlyMap<string, string> = new Map();
 
 /** Per-domain retention cap for the processed-outcome set (H-v) — mirrors the shell's
  *  `MAX_RECORDED_OUTCOMES_PER_CLIENT`: the sender caps what it can re-answer at 512 per client,
@@ -774,15 +632,23 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
    *  an evicted mid would be re-processed — the same bounded-window trade the shell makes, and it
    *  takes 512 interleaving non-applied outcomes on one domain to open it. */
   private readonly outcomesProcessed = new Map<string, Set<number>>();
-  /** THE routing table (H-iii §3): per connected room `sourceKey` → per promoted table → its
-   *  client-held {@link RoomTableRouting}. Written ONLY by {@link promoteRoomTable} (same breath
-   *  as the engine attach + {@link promotedTables}); read by {@link deriveDomain} and — via
-   *  {@link roomTablesFor} — the client's `__realtimeInspect` bookkeeping. */
-  private readonly roomRouting = new Map<string, Map<string, RoomTableRouting>>();
-  /** Q6 counters ({@link RoutingInspect}): successful derivations per room. */
-  private readonly routingDerived = new Map<string, number>();
-  /** Q6 counters ({@link RoutingInspect}): derivation failures per {@link RoutingFailureReason}. */
-  private readonly routingReasons = new Map<string, number>();
+  /** THE room-table registry (302 §2 — one source per table): per connected room `sourceKey`, the
+   *  wire-table → engine-table map for the tables that room OWNS (its writable scope). Written by
+   *  {@link registerRoomTables} (same breath as the engine registration); read by the gate's
+   *  release rename/filter, the mutator staging map, the view swap ({@link processSwapIns}), and
+   *  the client's `__realtimeInspect` bookkeeping. The record outlives a downgrade's disconnect —
+   *  the ghost's views still read the engine tables — and drops at {@link dropGhost} (or the last
+   *  clean release via {@link unregisterRoomTables}). */
+  private readonly roomTables = new Map<string, Map<string, string>>();
+  /** Local view qids currently REGISTERED on a room's namespaced tables (302 §4 swap-in), →
+   *  their sourceKey. Set by {@link processSwapIns}; cleared by the swap-back ({@link dropGhost})
+   *  and view teardown. The original AST stays in {@link asts} throughout — the swap re-registers
+   *  only the ENGINE query. */
+  private readonly roomSwappedViews = new Map<QueryId, string>();
+  /** Room subs whose FIRST snapshot released in the current release — their views swap onto the
+   *  room tables at the release tail ({@link processSwapIns}), strictly AFTER the reconcile folded
+   *  the snapshot into those tables (swapping earlier would hydrate the view EMPTY, a flash). */
+  private readonly pendingSwapIns = new Set<RemoteSub>();
   /** The live fold entries, by fold key `${name}\0${identityJSON}` — at most one per key
    *  (FOLDED-MUTATIONS-DESIGN §8). Insertion order is creation order (the drain/flush tiebreak). */
   private readonly folds = new Map<string, FoldRecord>();
@@ -805,47 +671,6 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
    *  scalars (`__inspect`) read it directly; its `sync` IS {@link sync} (the agg overlay and
    *  synthetic tables are daemon-tracked by design). */
   private readonly daemonGate: SourceGate;
-  /** Tables promoted to a MERGED multi-source engine (a room source attached). Written by the one
-   *  promotion seam ({@link promoteRoomTable}; the test-named {@link __addRoomSource} and Slice
-   *  G-v's lease-driven promotion from `RoomTableSpec[]` both flow through it). Read by the §7.3
-   *  hold-back trigger in
-   *  {@link applyRelease}: parking on a never-promoted (Collapsed) table is SKIPPED — inert anyway
-   *  today (`rewind_collapsed` never consults `held_back`), and a live hazard if the table later
-   *  promotes (a stale Collapsed-era entry turns overlay-first-visible and pins forever). Slice H's
-   *  prove-or-slow-path routing keeps the real scenario — a room-confirmed mutation writing a
-   *  Collapsed table — impossible; this gate covers the window until then. */
-  private readonly promotedTables = new Set<string>();
-  /** The §301 pin registry ({@link EchoFencePin}): every parked §7.3 hold-back's delivery-fence
-   *  inputs, keyed `${table}\0${sourceKey}\0${pkKey}`. Written in the same breath as the
-   *  `holdBack`/`holdBackAbsent` park; read by {@link dropEchoFencePins} at the tail of every
-   *  release. Empty on every single-domain client — the drop pass is then a structural no-op. */
-  private readonly pins = new Map<string, EchoFencePin>();
-  /** The §301 direction-A fence input: per room domain, the highest lmid the DAEMON-CARRIED
-   *  ledger rows have folded ({@link foldSystemFrames} step 2 — and ONLY that path: the room
-   *  socket's own lmid stream confirms long before the flush reaches the daemon, so it folds
-   *  into the shared {@link watermark} but never here, 301 §1.1). When this covers a pin's mid,
-   *  the same coherent release (or an earlier one) folded the flush data that carried it into
-   *  the daemon baseline — the fence. */
-  private readonly daemonCarriedLmid = new Map<string, number>();
-  /** The §301 §2.4 boot rule's inputs: the daemon boot ids this client has OBSERVED, in order
-   *  (id → ordinal), plus the current one. Boot ids are opaque — ordering is the client's own
-   *  observation ({@link OptimisticSource.onBootId} on the daemon gate). Direction-B pins stamp
-   *  the current boot; a room advertising a LATER-observed boot proves absorption (its
-   *  re-snapshot came from a daemon state that durably includes the confirmed write). */
-  private readonly daemonBootOrdinals = new Map<string, number>();
-  private daemonBootId: string | undefined;
-  /** The per-read provenance probe `invoke` hands `trackingTx` when recording is armed (H-ii,
-   *  §3.2 #3): the engine's `provenanceOf` — the VISIBLE overlay-first winner for the row's pk,
-   *  read from LIVE pre-commit state (an open txn's staged writes are not consulted; H-i). Gated
-   *  on PER-TABLE {@link promotedTables} membership — the cheapest existing signal, and the
-   *  correct one: provenance is an ENGINE-merge question, not a channel question ({@link gates}
-   *  can hold a connected-but-unpromoted room feed, and the oracle harness promotes with no gate),
-   *  and a never-promoted (Collapsed) table is daemon-owned by construction. So a pure
-   *  single-domain app pays ZERO wasm calls per recorded read; the recorded `source` is then
-   *  `undefined`, which is also correct — everything is daemon-owned (see {@link ReadRecord}). */
-  private readonly readProvenance = (table: string, row: WireValue[]): string | undefined =>
-    this.promotedTables.has(table) ? this.local.provenanceOf(table, row) : undefined;
-
   // --- the §4 lifecycle SYSTEM-STREAM plane (Slice I-iii) --------------------------------
   /** System retains by source qid ({@link retainSystemQuery}): a subscription with NO store view
    *  and NO user-visible table — its frames buffer on its gate exactly like {@link LMID_QID}'s and
@@ -887,6 +712,12 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
    *  only through outcome resolution; the ghost holds rather than inventing a timeout-retire).
    *  Default no-op. */
   private downgradeStuckHandler: (event: DowngradeStuckEvent) => void = () => {};
+  /** The 302 §6.1 context-coverage surface ({@link onRoomContextJoin}) — fired at most once per
+   *  view ({@link contextJoinWarned}), at swap-in, when its AST references tables the room does
+   *  not own. Default no-op. */
+  private roomContextJoinHandler: (event: RoomContextJoinEvent) => void = () => {};
+  /** Views the context-coverage event already fired for (once per view; cleared on teardown). */
+  private readonly contextJoinWarned = new Set<QueryId>();
 
   private readonly asts = new Map<QueryId, Ast>();
   /** Per query: the base tables its result can draw from (from the AST tree). */
@@ -968,12 +799,6 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     source.onNormalized((qid, ev) => this.onFrame(gate, qid, ev));
     source.onProgress((frame) => this.onGateProgress(gate, frame));
     source.onRestart?.(() => this.resetGate(gate));
-    // §301 §2.4: the DAEMON channel's observed boot-id stream seeds the client-local boot
-    // ordinals the direction-B fence's boot rule compares against (boot ids are opaque; order is
-    // the client's own observation). Only the daemon gate's boots matter — a room's advertised
-    // `upstreamBoot` names a DAEMON boot, and room-channel incarnations are handled by
-    // `resetGate`. Optional: an in-process source never reports one.
-    if (key === "daemon") source.onBootId?.((bootId) => this.observeDaemonBoot(bootId));
     // The deopt handshake's client half (H-v §3.3): the channel's `mutationOutcome` frames arrive
     // as `(domain = gate.key, frame)`. OUT-OF-BAND — the source dispatches on arrival and this
     // handler runs immediately, NEVER behind the gate's cv buffer: a deopt must migrate its entry
@@ -1006,7 +831,49 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     if (this.gates.has(sourceKey)) {
       throw new Error(`optimistic backend: source ${sourceKey} is already connected`);
     }
-    this.attachGate(sourceKey, source, new NormalizedSync(this.pkCols, this.colCounts));
+    const gate = this.attachGate(sourceKey, source, new NormalizedSync(this.pkCols, this.colCounts));
+    // A re-upgrade of a doc whose tables are still registered (a ghost that never dropped, or a
+    // quick down/up bounce) adopts the surviving record as this incarnation's rename map.
+    const tables = this.roomTables.get(sourceKey);
+    if (tables !== undefined) gate.tableMap = tables;
+    // …and CANCELS the pending swap-back: the room is the authority again, its views stay swapped,
+    // and a ghost left armed would fire against this LIVE gate when the old fence clears —
+    // un-swapping the views and unregistering the namespaced tables the gate's tableMap still
+    // renames deltas into (the next release would then throw from serverBatchBegin and poison the
+    // rebase state). A future downgrade arms a fresh ghost with its own fence.
+    this.ghosts.delete(sourceKey);
+  }
+
+  /** Register the tables room `sourceKey` OWNS (its writable scope — 302 §2): each wire table
+   *  gets its own namespaced ENGINE table (`{@link roomEngineTable}`), an ordinary tracked table
+   *  whose sole authority is the room channel. From here on the channel's released deltas rename
+   *  into these tables (wire tables outside the map are DROPPED — context stays daemon-owned,
+   *  302 §6), room-domain mutators stage onto them, and a room-homed view swaps onto them once
+   *  the room sub hydrates ({@link processSwapIns}). Idempotent per (sourceKey, table); a wire
+   *  table unknown to the schema is skipped (nothing to hold rows for). */
+  registerRoomTables(sourceKey: string, tables: readonly string[]): void {
+    if (sourceKey === "daemon") {
+      throw new Error("optimistic backend: the daemon is not a room — no namespaced tables");
+    }
+    let map = this.roomTables.get(sourceKey);
+    if (!map) this.roomTables.set(sourceKey, (map = new Map()));
+    for (const table of tables) {
+      if (map.has(table)) continue;
+      const spec = this.specs[table];
+      if (spec === undefined || this.localTables.has(table)) continue;
+      const engineTable = roomEngineTable(table, sourceKey);
+      this.local.registerTable(engineTable, { columns: spec.columns, primaryKey: spec.primaryKey });
+      map.set(table, engineTable);
+    }
+    const gate = this.gates.get(sourceKey);
+    if (gate !== undefined) gate.tableMap = map;
+  }
+
+  /** The wire-table → engine-table map for room `sourceKey`'s owned tables (empty when none) —
+   *  the client's idempotence check and `__realtimeInspect` read THIS record (one source of
+   *  truth; the client keeps no shadow copy). */
+  roomTablesFor(sourceKey: string): ReadonlyMap<string, string> {
+    return this.roomTables.get(sourceKey) ?? EMPTY_ROOM_TABLES;
   }
 
   // --- the Backend seam ---------------------------------------------------------
@@ -1047,7 +914,7 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     // child is left a native reduce (L1) — `rewriteAggregates`/`ensureSyntheticTables` skip it.
     this.ensureSyntheticTables(qid, ast);
     // Local first (synchronous empty view), then the server stream hydrates it.
-    this.local.registerQuery(qid, rewriteAggregates(ast, (t) => this.localTables.has(t)));
+    this.local.registerQuery(qid, this.plainEngineAst(ast));
     if (remote) {
       // A remote query is `unknown` until its first server snapshot lands (hydration); retainRemote
       // attaches it to the sub and sets the lifecycle against the sub's hydration state.
@@ -1117,6 +984,8 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
   }
 
   unregisterQuery(qid: QueryId): void {
+    this.roomSwappedViews.delete(qid); // a swapped view's teardown forgets its room backing
+    this.contextJoinWarned.delete(qid); // …and its once-per-view coverage-warn latch
     const remoteQid = this.releaseRemote(qid);
     // GC: rows this remote footprint SOLELY referenced fall to refcount 0 → net removes. A qid
     // lives on ONE channel, so at most one gate's dropQuery is non-empty (dropQuery of an
@@ -1126,7 +995,7 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
       this.pendingRetargetGc.delete(remoteQid); // the sweep below covers a mid-retarget teardown
       for (const gate of this.gates.values()) {
         gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
-        const gc = gate.sync.dropQuery(remoteQid);
+        const gc = mapGateDeltas(gate, gate.sync.dropQuery(remoteQid));
         if (gc.length) gcs.push([gate.key, gc]);
       }
     }
@@ -1176,7 +1045,7 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     // Per-gate sweep, like `unregisterQuery`: at most one gate owned this qid's frames/rows.
     for (const gate of this.gates.values()) {
       gate.buffer = gate.buffer.filter((f) => f.qid !== remoteQid);
-      const gc = gate.sync.dropQuery(remoteQid);
+      const gc = mapGateDeltas(gate, gate.sync.dropQuery(remoteQid));
       if (gc.length) this.runReconcileCycle(gate.key, gc);
     }
   }
@@ -1199,17 +1068,15 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
    *      precedent), flip `sub.channel`, re-arm `sub.hydrated` (the room's own snapshot is the
    *      cutover point), and register on the room source (its resolver presents the handed
    *      roomToken). The old gate's SYNC rows are deliberately NOT dropped: they keep the view's
-   *      rows visible through the window (merge: the daemon-tier holder). Local views keep their
-   *      `hydrated` membership — the view stays `complete` on its authoritative daemon rows.
-   *   2. AT THE ROOM'S FIRST RELEASED SNAPSHOT ({@link flushRetargetGc}): the room source now
-   *      holds the footprint rows (folded via `serverBatchBegin(sourceKey)` — value-equal rows
-   *      re-hydrate as a net-zero diff, RT §3.4 per channel), so the deferred
-   *      `dropQuery`+reconcile on the OLD gate flips each pk's winner daemon→room value-equal:
-   *      net-zero again. No emission carries a disappearance at any point.
+   *      plain tables populated through the window — the view still reads them until the swap.
+   *   2. AT THE ROOM'S FIRST RELEASED SNAPSHOT: the reconcile folds the snapshot into the room's
+   *      namespaced tables, the release tail SWAPS every local view onto them (302 §4.1,
+   *      {@link processSwapIns} — the accepted-flash boundary), and {@link flushRetargetGc}'s
+   *      deferred `dropQuery`+reconcile on the OLD gate then GCs the plain-table rows the sub
+   *      alone referenced — invisible to the swapped views.
    *
    *  Idempotent per target channel: a sub already on `sourceKey` returns immediately (the
-   *  double-doorbell / re-entrancy guard — one retarget per (query, sourceKey), mirroring
-   *  {@link promoteRoomTable}'s caller-side per-(sourceKey, table) idempotence). Validates before
+   *  double-doorbell / re-entrancy guard — one retarget per (query, sourceKey)). Validates before
    *  mutating: a throw here leaves the sub fully daemon-attached (the client's fail-open). */
   retargetRemoteQuery(remote: RemoteQuery, sourceKey: string): QueryId {
     const newGate = this.requireGate(sourceKey); // throw loudly BEFORE any sub state moves
@@ -1251,42 +1118,31 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
       this.pendingRetargetGc.delete(sourceQid);
       const oldGate = this.gates.get(oldGateKey);
       if (!oldGate) continue;
-      const gc = oldGate.sync.dropQuery(sourceQid);
+      const gc = mapGateDeltas(oldGate, oldGate.sync.dropQuery(sourceQid));
       if (gc.length) this.runReconcileCycle(oldGateKey, gc);
     }
   }
 
   // --- the §4.2 downgrade: demote → ghost → fence → drop (Slice I-v) ----------------------
 
-  /** The I-v downgrade orchestration primitive (§4.2/§7.4): retire room `sourceKey` behind the
-   *  watermark fence. The caller has ALREADY retargeted every live sub off the channel
-   *  ({@link retargetRemoteQuery} room→daemon — validated loudly below) and holds the fence from
-   *  the api-server's downgrade response (`finalFlushSeq` = the room's last COMMITTED flush seq;
-   *  `doc` keys the §4.2 watermark fold, {@link roomWatermarks}). Steps, in order:
+  /** The I-v downgrade orchestration primitive (§4.2/§7.4, re-expressed by 302 §4.2 as the
+   *  SWAP-BACK GATE): retire room `sourceKey` behind the watermark fence. The caller has ALREADY
+   *  retargeted every live sub off the channel ({@link retargetRemoteQuery} room→daemon —
+   *  validated loudly below) and holds the fence from the api-server's downgrade response
+   *  (`finalFlushSeq` = the room's last COMMITTED flush seq; `doc` keys the §4.2 watermark fold,
+   *  {@link roomWatermarks}). Steps, in order:
    *
-   *   1. **De-candidacy NOW**: the sourceKey's {@link roomRouting} entries are removed, so
-   *      {@link deriveDomain} stops proposing the room (zero candidates ⇒ `"daemon"`). Unsent
-   *      pending (`mid === null`) re-routes for free — a fold's flush re-derives from the live
-   *      candidate set (§7.5 rule 1). The engine's frozen scope still ANSWERS (`writableMatches`
-   *      / `provenanceOf` — freezing gates serving, not the scope definition); routing is
-   *      TS-gated here.
-   *   2. **Freeze** the WRITABLE promoted tables (`freezeSource`): the room slice becomes the
-   *      §4.2 ghost — wins-if-present in the merge (D4), so its rows (at-or-ahead of the daemon
-   *      until the flush echoes) stay visible while the slice accepts nothing. Context tables
-   *      (`writable: false`) are deliberately NOT frozen: the daemon is authoritative for them
-   *      LIVE (§5.2's context tier) and freezing would invert that, pinning a possibly-BEHIND
-   *      relayed copy over fresher daemon rows; unfrozen they keep exactly the live tiering.
-   *   3. **Disconnect** the channel ({@link disconnectSource}): handlers detached, gate + buffer
+   *   1. **Disconnect** the channel ({@link disconnectSource}): handlers detached, gate + buffer
    *      dropped. `nextMid`/`watermark`/processed-outcomes for the domain are KEPT FOREVER (§7.1:
    *      an assigned mid pins its domain; a later re-upgrade of the same doc continues the
    *      sequence — {@link connectSource} attaches a fresh gate and the lmid snapshot max-folds
    *      into the surviving watermark). Disconnecting BEFORE the daemon sub's first release is
    *      load-bearing: it makes {@link flushRetargetGc}'s deferred old-channel GC a no-op (gate
-   *      gone ⇒ record deleted, nothing dropped) — running that GC would rewind the room slice's
-   *      rows at daemon hydration, i.e. BEFORE the fence, surfacing a lagging follower's stale
-   *      images (the exact regression §4.2 exists to prevent). The ghost's rows leave only
-   *      through {@link dropGhost}'s `removeRoomSource`, value-equal under the fence.
-   *   4. **Ghost + first evaluation**: the record joins {@link ghosts} and is evaluated once
+   *      gone ⇒ record deleted, nothing dropped). The room's namespaced tables — and the views
+   *      swapped onto them — deliberately stay: frozen at the room's last state, they keep the
+   *      document visible while the falling-back follower may still lack the final flush.
+   *      Swapping back earlier would show its pre-flush images — the regression §4.2 prevents.
+   *   2. **Ghost + first evaluation**: the record joins {@link ghosts} and is evaluated once
    *      immediately — `finalFlushSeq === 0` (a never-flushed room) with no room-domain pending
    *      drops on the spot, the single-daemon first-frame case.
    *
@@ -1298,7 +1154,6 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     if (sourceKey === "daemon") {
       throw new Error("optimistic backend: the daemon source cannot be demoted");
     }
-    if (this.ghosts.has(sourceKey)) return; // idempotent — one ghost per source
     // Validate FIRST (nothing mutated yet): a live sub still on the channel would silently
     // starve once the gate detaches — the caller must retarget every sub off the room first.
     for (const sub of this.remoteSubs.values()) {
@@ -1308,13 +1163,22 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
         );
       }
     }
-    const routing = this.roomRouting.get(sourceKey);
-    const tables = routing ? [...routing.keys()] : [];
-    const writable = routing ? tables.filter((t) => routing.get(t)!.writable) : [];
-    this.roomRouting.delete(sourceKey); // (1) de-candidacy
-    for (const table of writable) this.local.freezeSource(table, sourceKey); // (2) the ghost
-    this.disconnectSource(sourceKey); // (3) the channel
-    this.ghosts.set(sourceKey, { doc, finalFlushSeq, tables, stuckReported: false }); // (4)
+    // Idempotent per sourceKey (co-tenant queries sharing the room demote into the existing
+    // ghost) — but NEVER a bare early-return: each demote carries its own fence, so keep the
+    // NEWEST flush (monotone max — swapping back on an older fence would show pre-flush images),
+    // and disconnect defensively in case a gate re-attached since the ghost was armed (a
+    // down→up→down bounce; {@link connectSource} cancels the ghost on re-upgrade, so this arm
+    // normally finds no gate — but a stale gate left connected would let the next daemon release
+    // GC the room slice out from under the still-swapped views, the §4.2 regression).
+    const existing = this.ghosts.get(sourceKey);
+    if (existing) {
+      this.disconnectSource(sourceKey);
+      existing.finalFlushSeq = Math.max(existing.finalFlushSeq, finalFlushSeq);
+      this.evaluateGhosts();
+      return;
+    }
+    this.disconnectSource(sourceKey); // (1) the channel
+    this.ghosts.set(sourceKey, { doc, finalFlushSeq, stuckReported: false }); // (2)
     this.evaluateGhosts();
   }
 
@@ -1350,6 +1214,13 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     this.downgradeStuckHandler = handler;
   }
 
+  /** Register the 302 §6.1 context-coverage sink — see {@link RoomContextJoinEvent}. One handler
+   *  (a later registration replaces it, the {@link onScopeSessions} convention); client.ts maps
+   *  it onto the loud anomaly surface. */
+  onRoomContextJoin(handler: (event: RoomContextJoinEvent) => void): void {
+    this.roomContextJoinHandler = handler;
+  }
+
   /** The I-v ghost-drop watcher (§4.2), run after every applied release ({@link applyRelease} —
    *  the seam where {@link roomWatermarks} has just folded and the confirm-drop has just run) and
    *  once at demote time. For each ghost: the fence must be satisfied
@@ -1361,6 +1232,10 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
   private evaluateGhosts(): void {
     if (this.ghosts.size === 0) return; // every non-downgrade release: structural no-op
     for (const [sourceKey, ghost] of [...this.ghosts]) {
+      // A LIVE gate means the doc re-upgraded — dropping now would dismantle the live room
+      // (un-swap its views, unregister the tables its tableMap renames into). connectSource
+      // cancels the ghost on re-upgrade, so this guard is purely defensive; hold, never drop.
+      if (this.gates.has(sourceKey)) continue;
       if ((this.roomWatermarks.get(ghost.doc) ?? 0) < ghost.finalFlushSeq) continue; // fence holds
       const stuck = this.pendingMutations.filter((p) => p.domain === sourceKey && p.mid !== null);
       if (stuck.length > 0) {
@@ -1370,47 +1245,48 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
         }
         continue; // hold — never a timeout-retire (§7.5 rule 2)
       }
-      this.dropGhost(sourceKey, ghost);
+      this.dropGhost(sourceKey);
     }
   }
 
-  /** Drop one cleared ghost (§4.2 end state): detach every promoted table's room source (D2
-   *  stay-merged — `removeRoomSource` reconciles each held pk to daemon-or-vanish, value-equal
-   *  under the fence, so visually a no-op), release the {@link promotedTables} record for tables
-   *  no OTHER room/ghost still holds, then run ONE daemon reconcile so entries whose writes had
-   *  staged onto the ghost slice re-invoke and re-stage by provenance onto the daemon slice (the
-   *  removal took their staged copies with the tree; provenance now answers daemon). The whole
-   *  drop runs under one commit boundary so the removal's compensating deltas and the re-staged
-   *  predictions notify as ONE step. After this, a FUTURE upgrade of the same doc promotes
-   *  again from scratch — the round trip is pinned by the §8.5 lanes. */
-  private dropGhost(sourceKey: string, ghost: RoomGhost): void {
+  /** Drop one cleared ghost — the 302 §4.2 SWAP-BACK: under the fence the daemon tables are
+   *  value-equal-or-ahead of the room's final state, so (1) every view swapped onto the room's
+   *  namespaced tables re-registers on its ORIGINAL (daemon-table) AST — visually a no-op, the
+   *  Store folds the re-hello as an in-place reset; (2) the namespaced tables unregister (no
+   *  reader is left after the swap); (3) ONE daemon reconcile re-invokes the pending set so any
+   *  entry whose writes had staged onto the now-gone room tables re-stages onto the daemon tables
+   *  (its domain policy stopped naming the dead room when the client dropped it). The whole drop
+   *  runs under one commit boundary so the swap and the re-staged predictions notify as ONE step.
+   *  After this, a FUTURE upgrade of the same doc registers again from scratch. */
+  private dropGhost(sourceKey: string): void {
     this.ghosts.delete(sourceKey);
-    // Re-stage eligibility FIRST: a pending entry staged (only) on the ghost slice must join the
-    // daemon reconcile below (the cycle filter is `touchedSources.has(sourceKey)`) — union, never
-    // shrink, the §5.3 rule.
-    let restage = false;
-    for (const p of this.pendingMutations) {
-      if (p.touchedSources.has(sourceKey)) {
-        p.touchedSources.add("daemon");
-        restage = true;
-      }
-    }
     this.inOneCommit(() => {
-      for (const table of ghost.tables) this.local.removeRoomSource(table, sourceKey);
-      for (const table of ghost.tables) {
-        let held = false;
-        for (const byTable of this.roomRouting.values()) if (byTable.has(table)) held = true;
-        for (const g of this.ghosts.values()) if (g.tables.includes(table)) held = true;
-        if (!held) this.promotedTables.delete(table);
+      for (const [qid, key] of [...this.roomSwappedViews]) {
+        if (key !== sourceKey) continue;
+        this.roomSwappedViews.delete(qid);
+        const ast = this.asts.get(qid);
+        if (ast === undefined) continue;
+        this.local.unregisterQuery(qid);
+        this.local.registerQuery(qid, this.plainEngineAst(ast));
       }
-      // One daemon reconcile replays the re-staged entries onto the daemon slice. Run whenever
-      // any pending exists: the removal above may have taken a staged write with the tree even
-      // when `touchedSources` never recorded the ghost (defensive; an empty-pending drop skips).
-      if (restage || this.pendingMutations.length > 0) this.runReconcileCycle("daemon", []);
+      this.unregisterRoomTables(sourceKey);
+      // One daemon reconcile re-stages the pending set onto the surviving tables. Run whenever
+      // any pending exists: unregistering the room tables took their staged copies with the tree.
+      if (this.pendingMutations.length > 0) this.runReconcileCycle("daemon", []);
     });
     this.refreshPending(); // the reconcile may have dropped a throwing re-invocation
   }
 
+  /** Unregister room `sourceKey`'s namespaced engine tables and drop the {@link roomTables}
+   *  record. Callers must have no view registered on them (the engine refuses otherwise —
+   *  loud by design). No-op for an unknown sourceKey. */
+  unregisterRoomTables(sourceKey: string): void {
+    const map = this.roomTables.get(sourceKey);
+    if (!map) return;
+    this.roomTables.delete(sourceKey);
+    for (const engineTable of map.values()) this.local.unregisterTable(engineTable);
+  }
+
   // --- the §4 lifecycle SYSTEM-STREAM retains (Slice I-iii) ------------------------------
 
   /** Retain one minted SYSTEM subscription (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §4, Slice
@@ -1576,192 +1452,63 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     return { mid, seq: ++this.dealSeq };
   }
 
-  // --- the §3 prove-or-slow-path ROUTER (H-iii) -----------------------------------
-  //
-  // RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §3: a mutation routes to room R iff every row its
-  // prediction run WROTE is provably inside R's writable scope and every read it RECORDED is
-  // provably covered by R's footprint — ANY unproven condition routes slow (the §0 asymmetry:
-  // mis-guessing "slow" costs one round-trip; mis-guessing "room" would commit divergent data).
-  // Failure is therefore SILENT "daemon" — never a throw, never a warning per call — plus the Q6
-  // per-reason counters ({@link RoutingInspect}).
-  //
-  // The proof evaluates against the ENGINE wherever the engine has an answer: `writableMatches`
-  // (the registered compiled writable scope — the same predicate the merge's winner tiering uses)
-  // and `provenanceOf` (the visible overlay-first winner). It runs AFTER the prediction committed,
-  // so the probes see the prediction's own staged effects — which only ever strengthens the
-  // conservative direction (a fresh pk reports "daemon"/undefined and neither disqualifies).
+  // --- the DECLARED router (302 §5: declared, not derived) --------------------------------
   //
-  // ** THE ONE CLIENT-SIDE NON-ENGINE EVALUATOR — deliberately minimal (the TS evaluation
-  // caveat). ** Evaluating `footprintWhere` on a read's pk cells ({@link evalFootprintOnPk}) is
-  // the single place Slice H allows a non-engine evaluator, and it is restricted to STRICT cell
-  // equality only: `simple` `=` / `!=` between a pk column and a same-primitive-type non-null
-  // literal, composed under and/or (the empty AND is the vacuous-true exact-unconstrained-root
-  // emission and evaluates true). ANY other op or shape — LIKE, <, >=, IS, IN, null operands,
-  // cross-type comparisons, column-vs-column — is NOT EVALUABLE and fails to the daemon.
-  // Justification: a mis-evaluation here cannot commit divergence — the room GATE (H-iv) re-proves
-  // every write and absent read engine-side at commit and deopts, so a wrong client verdict only
-  // costs a wasted hop (route room → gate deopt) or a skipped optimization (route daemon); and
-  // restricting to strict equality on non-null, same-typed pk cells removes the entire
-  // null/collation/coercion divergence space between this evaluator and the engine's comparators.
-  // The gate remains the contract; this router is the optimization.
-  //
-  // ** H-v (SHIPPED — the router's missing recovery half). ** A derived (or pinned) room route
-  // whose gate DEOPTS (the H-iv-b `mutationOutcome {kind:"deopt"}` frame — the mid is burnt in
-  // the room ledger, no effects committed) is re-enqueued onto the daemon stream by
-  // {@link handleMutationOutcome}: the entry flips in place (fresh daemon mid, ORIGINAL seq,
-  // prediction applied throughout), or — already retired — re-invokes from the frame's echoed
-  // name/args pinned to the daemon. A reconnect re-sends unconfirmed mids so a frame lost with
-  // its socket is re-answered ({@link resendPending}). A wrong client verdict therefore costs
-  // exactly one room round-trip plus one burnt room-mid (§3.3), never a stranded prediction.
-
-  /** The route decision for one invocation (invoke, and again at fold flush): the explicit
-   *  `domainPolicy` is the OVERRIDE — a string pins that domain verbatim, no proof runs;
-   *  `undefined` (or no policy configured) derives per §3. */
-  private resolveDomain(name: string, args: unknown, writes: WriteSet, reads: ReadLog): string {
-    const pinned = this.domainPolicy(name, args);
-    if (pinned !== undefined) return pinned;
-    return this.deriveDomain(writes, reads);
-  }
-
-  /** §9.3: does this fold's write-set route into a room (vs the daemon)? Used ONLY to pick the
-   *  {@link FoldOptions.roomDebounceMs} cadence at a fold window's start. It probes
-   *  {@link resolveDomain} but RESTORES the Q6 routing diagnostics afterward — the authoritative
-   *  route and its single counter bump belong to the flush ({@link flushFold}), not to this
-   *  interval hint. A fold's reads are provably empty (the read-trap arms on that path), so the
-   *  write-set alone decides. */
-  private routesToRoom(name: string, args: unknown, writes: WriteSet): boolean {
-    const reasons = [...this.routingReasons];
-    const derived = [...this.routingDerived];
-    const domain = this.resolveDomain(name, args, writes, { reads: [], queries: [] });
-    this.routingReasons.clear();
-    for (const [k, v] of reasons) this.routingReasons.set(k, v);
-    this.routingDerived.clear();
-    for (const [k, v] of derived) this.routingDerived.set(k, v);
-    return domain !== "daemon";
-  }
-
-  /** Count one derivation failure ({@link RoutingInspect}). Returns `false` so the per-candidate
-   *  proof's call sites read `return this.failDerivation(...)`. */
-  private failDerivation(reason: RoutingFailureReason): false {
-    this.routingReasons.set(reason, (this.routingReasons.get(reason) ?? 0) + 1);
-    return false;
-  }
-
-  /** The §3 derivation. Candidates are the connected room gates with at least one promoted table
-   *  (a promoted table with no gate cannot confirm; a gate with no promoted table holds no data to
-   *  prove against). Zero candidates ⇒ `"daemon"` (the single-domain fast path). The proof runs
-   *  per candidate and EXACTLY ONE must survive — two rooms both proving routes slow (principled
-   *  disambiguation is a §9.2 multi-room NON-goal, deferred past Slice J; slow is always sound). */
-  private deriveDomain(writes: WriteSet, reads: ReadLog): string {
-    const candidates: string[] = [];
-    for (const key of this.gates.keys()) {
-      if (key === "daemon") continue;
-      if ((this.roomRouting.get(key)?.size ?? 0) > 0) candidates.push(key);
-    }
-    if (candidates.length === 0) {
-      this.failDerivation("no-candidates");
-      return "daemon";
-    }
-    // tx.query is not room-executable client-side: predicate containment (rindle-cover) is
-    // native-only BY DESIGN, so a declarative read fails the WHOLE derivation unconditionally.
-    // This is required, not conservative.
-    if (reads.queries.length > 0) {
-      this.failDerivation("tx-query");
-      return "daemon";
-    }
-    const proven = candidates.filter((room) => this.provesRoom(room, writes, reads));
-    if (proven.length === 1) {
-      const room = proven[0];
-      this.routingDerived.set(room, (this.routingDerived.get(room) ?? 0) + 1);
-      return room;
-    }
-    if (proven.length > 1) this.failDerivation("ambiguous");
-    return "daemon"; // zero survivors: each candidate already counted its own failure reason
-  }
-
-  /** One candidate room's §3 proof over the captured write-set + read-log. Every write must pass
-   *  ALL the write rules; every read must pass ONE of the read rules. First failure wins (and is
-   *  counted); order is deterministic (write-set map order, then read-log order). */
-  private provesRoom(room: string, writes: WriteSet, reads: ReadLog): boolean {
-    const specs = this.roomRouting.get(room);
-    // --- write rules: every WriteRecord passes ALL of #1–#4 -------------------------------
-    for (const [table, byPk] of writes) {
-      // #1: the table is promoted for R with a writable (predicate-kind) spec. A context table
-      // (`writable: none`), an un-promoted table, and a local table (unreachable — the mutator
-      // guard refuses local writes at stage time) all fail here.
-      const spec = specs?.get(table);
-      if (spec === undefined || !spec.writable) return this.failDerivation("write-unwritable-table");
-      const colIx = this.colIndex[table];
-      for (const rec of byPk.values()) {
-        const removeShape = rec.row === undefined;
-        // #2: the registered writable scope, evaluated BY THE ENGINE on the post-image for
-        // add/edit shapes and on the pre-image for removes (the row the room would delete). A
-        // remove record always carries its full-width pre-image (the H-ii capture contract);
-        // a violated contract fails closed rather than probing nothing.
-        const scopeRow = removeShape ? rec.oldRow : rec.row;
-        if (scopeRow === undefined || !this.local.writableMatches(table, room, scopeRow)) {
-          return this.failDerivation("write-scope-miss");
-        }
-        // #3: join-key no-change. An edit-shape (row + oldRow — the oldRow is the txn-entry base)
-        // must keep every joinKeyCols cell STRICTLY identical old-vs-new; an add-shape may SET
-        // them (it creates the correlation); removes are exempt. A join-key column missing from
-        // the schema is a spec bug — fail closed.
-        if (!removeShape && rec.oldRow !== undefined) {
-          for (const col of spec.joinKeyCols) {
-            const i = colIx?.get(col);
-            if (i === undefined || !identicalCell(rec.oldRow[i], rec.row![i])) {
-              return this.failDerivation("write-join-key-change");
-            }
-          }
-        }
-        // #4: provenance corroboration — the engine routes an Edit by its OLD row (H-i), so probe
-        // the pre-image for edit/remove shapes and the post-image for add-shapes. A winner naming
-        // a DIFFERENT room disqualifies; "daemon"/undefined does NOT (a thin slice, or a fresh pk
-        // — fresh pks stage to the daemon slice by the E2 decision, kept permanently: the
-        // room-side authoritative run is the committing execution either way).
-        const probeRow = rec.oldRow ?? rec.row;
-        if (probeRow !== undefined) {
-          const src = this.local.provenanceOf(table, probeRow);
-          if (src !== undefined && src !== "daemon" && src !== room) {
-            return this.failDerivation("write-cross-room-provenance");
-          }
-        }
-      }
-    }
-    // --- read rules: every ReadRecord passes ONE ------------------------------------------
-    // (tx.query already failed the whole derivation in deriveDomain — never reaches here.)
-    for (const r of reads.reads) {
-      // Self-read: the pk is in THIS invocation's write-set for that table — the write rules
-      // above already judged it (covers the keyed writers' probe-then-write shape). NOTE the
-      // read-log reflects the ORIGINAL invoke only (the pre-existing capture caveat).
-      if (writes.get(r.table)?.has(stableJson(r.pk))) continue;
-      if (r.source !== undefined) {
-        if (r.source === room) continue; // the room served the row — in-footprint by construction
-        if (r.source !== "daemon") return this.failDerivation("read-cross-room");
-      }
-      // Present-with-daemon/undefined source, or ABSENT (source is never recorded for those —
-      // including the un-promoted-table meaning of an absent key): the footprint-membership test
-      // on the PK ALONE. R's footprintWhere must exist, be key-decidable (every column it reads is
-      // a pk column), and evaluate TRUE on the read's pk cells:
-      //   present-daemon + TRUE  ⇒ the row is in the room's COMPLETE footprint ⇒ covered;
-      //   absent + TRUE          ⇒ absent-in-room = absent-in-truth ⇒ covered;
-      //   FALSE (either outcome) ⇒ fail — present-daemon-FALSE means the room lacks the row;
-      //     absent-FALSE is arguably provable (decidably-outside ⇒ the room never sees the pk)
-      //     but the room-side run would then read absent for a DIFFERENT reason than truth's —
-      //     stay CONSERVATIVE and fail;
-      //   no footprintWhere / not key-decidable / not evaluable ⇒ fail (see the evaluator caveat
-      //     on the router block comment).
-      const fw = specs?.get(r.table)?.footprintWhere;
-      if (fw === undefined) return this.failDerivation("read-no-footprint-where");
-      const tspec = this.specs[r.table];
-      const pkCols = tspec.primaryKey.map((i) => tspec.columns[i]);
-      if (!keyDecidable(fw, new Set(pkCols))) return this.failDerivation("read-not-key-decidable");
-      const pkCells = new Map<string, WireValue>(pkCols.map((c, j) => [c, r.pk[j]]));
-      const verdict = evalFootprintOnPk(fw, pkCells);
-      if (verdict === undefined) return this.failDerivation("read-not-evaluable");
-      if (!verdict) return this.failDerivation("read-outside-footprint");
-    }
-    return true;
+  // The user declares which mutators are room mutators; the client neither proves, derives,
+  // widens, nor falls back. The declaration reaches this backend as `domainPolicy` — the client
+  // layer resolves (mutator name, args) against its declared realtime mutators and the currently
+  // attached rooms. A misdeclaration fails SOFT (302 §5.1): a daemon-declared mutator touching
+  // room-visible data stages onto the daemon tables while the room-homed view reads the room
+  // tables — no optimistic feedback until the echo relays it a hop later, never a divergence.
+  // The room GATE stays the authoritative backstop: a room-routed mutation the room refuses comes
+  // back as a `mutationOutcome` deopt/reject frame and the H-v machinery below re-enqueues or
+  // surfaces it.
+
+  /** The declared confirming stream for one invocation: the `domainPolicy`'s verdict, `"daemon"`
+   *  when it abstains. Resolved BEFORE the prediction runs — the domain picks the staging map
+   *  (a room domain stages its owned tables onto the room's namespaced twins). */
+  private resolveDomain(name: string, args: unknown): string {
+    return this.domainPolicy(name, args) ?? "daemon";
+  }
+
+  /** The staging table map for a `domain`-routed prediction ({@link trackingTx}'s `stage`):
+   *  wire table → the room's namespaced engine table for the tables the room owns; identity for
+   *  everything else (including the whole map for the daemon domain). */
+  private stagingMap(domain: string): ReadonlyMap<string, string> | undefined {
+    return domain === "daemon" ? undefined : this.roomTables.get(domain);
+  }
+
+  /** The PLAIN (daemon-homed) engine AST for `ast` — aggregate relationships rewritten to their
+   *  synthetic `__agg_*` reads, no room renames. The ONE form every non-swapped engine
+   *  registration uses ({@link registerQuery}, {@link dropGhost}'s swap-back) and the base the
+   *  swap-in renames ({@link processSwapIns}). */
+  private plainEngineAst(ast: Ast): Ast {
+    return rewriteAggregates(ast, (t) => this.localTables.has(t));
+  }
+
+  /** Mutator names the cross-authority warn below already fired for (once per name). */
+  private readonly warnedCrossAuthority = new Set<string>();
+
+  /** 302 §5.1 dev-time guard: a room-DECLARED mutator wrote tables the room does not own. Those
+   *  writes staged onto the PLAIN daemon tables (the staging map covers only owned tables), but
+   *  the entry confirms on the ROOM stream — and only the room's OWNED tables flush back to the
+   *  daemon, so nothing upstream ever echoes them: once the room confirm retires the entry, the
+   *  next release's whole-store rewind reverts them for good. The first-party room shell refuses
+   *  such a mutation (the §3.3 deopt/reject backstop re-routes it to the daemon), so this warns
+   *  for the shapes where that backstop may be absent (a BYO relay) — loud, once, soft (§5.1:
+   *  misdeclarations never throw). */
+  private warnCrossAuthorityWrites(name: string, domain: string, touched: ReadonlySet<string>): void {
+    if (domain === "daemon" || this.warnedCrossAuthority.has(name)) return;
+    const map = this.roomTables.get(domain);
+    const staged = new Set(map?.values() ?? []);
+    const outside = [...touched].filter((t) => !staged.has(t));
+    if (outside.length === 0) return;
+    this.warnedCrossAuthority.add(name);
+    console.warn(
+      `[rindle] room mutator "${name}" wrote table(s) ${outside.join(", ")} that room ${JSON.stringify(domain)} does not own` +
+        ` (owned: ${map !== undefined && map.size > 0 ? [...map.keys()].join(", ") : "none"}) — these writes rely on the room` +
+        ` shell's deopt backstop and revert after the room confirm if the shell applies the mutation anyway (302 §5.1).`,
+    );
   }
 
   /** Run the named client mutator optimistically: the prediction applies to the live
@@ -1783,46 +1530,37 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     // One commit boundary spans the prediction AND the `__agg`-head reconcile below, so their views
     // (data + count) flush together rather than tearing across two engine commits.
     return this.inOneCommit(() => {
-      // Apply the prediction FIRST. If the mutator throws (client-side validation, a bad read),
+      // The confirming stream is DECLARED (302 §5), so it resolves BEFORE the prediction: the
+      // domain picks the staging map — a room-domain mutator's writes to the room's owned tables
+      // land on the namespaced engine twins the room-homed views read. An H-v deopt re-invocation
+      // pins via `pin` and the policy never runs.
+      const domain = pin ?? this.resolveDomain(name, args);
+      // Apply the prediction. If the mutator throws (client-side validation, a bad read),
       // the staged write is discarded (the wasm txn is a clean no-op until commit) and the throw
       // propagates with NO mid consumed — a burnt mid is a permanent server-side gap that
       // silently refuses every later mutation from this client (#10).
       const writes: WriteSet = new Map();
       const reads: ReadLog = { reads: [], queries: [] };
       const ops: ChildOp[] = [];
-      // Per-staged-write source keys (staged order), zipped with the `commitTracked` `sources[]`
-      // below to learn which physical source each pk routed onto (§5.3 filter + §7.3 hold-back).
-      const stagedKeys: string[] = [];
-      const sources = this.local.writeWith((tx) => {
+      this.local.writeWith((tx) => {
         this.runMutator(
           mutator,
-          // `readProvenance` rides only with recording (H-ii §3.2 #3): the folded path (trap, no
-          // readLog) and the reconcile replay (no readLog) never probe — see trackingTx.
-          trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, reads, stagedKeys, this.readProvenance),
+          trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, reads, this.stagingMap(domain)),
           args,
         );
       });
       // `touched` is DERIVED, never separately populated (§3.2 #1) — see {@link WriteSet}.
       const touched = new Set(writes.keys());
+      this.warnCrossAuthorityWrites(name, domain, touched);
       // Flush-on-enqueue (§4.2): a fold whose tables overlap this write must take its mid NOW, BEFORE
       // this write does, so wire order == local-apply order for any pair that can observe each other
       // (a read-dependent write reading a folded cell sees the same value optimistically and on the
       // wire — no snap). Drained folds ship with smaller mids; this write's mid is dealt after.
       this.drainOverlapping(touched);
-      // The confirming stream (§7.1): its ledger deals the mid and its watermark alone retires the
-      // entry. THE §3 ROUTER RUNS HERE (H-iii) — after the prediction (write/read capture is
-      // complete, and the engine holds the committed prediction the probes read) and BEFORE the
-      // mid is dealt: an assigned mid pins its domain forever (§7.1) — a re-invocation never
-      // re-routes. An explicit `domainPolicy` string pins verbatim (no proof); an H-v deopt
-      // re-invocation pins via `pin` (see {@link invokeWith}) and the router never runs.
-      const domain = pin ?? this.resolveDomain(name, args, writes, reads);
+      // The confirming stream's ledger deals the mid and its watermark alone retires the entry
+      // (§7.1). An assigned mid pins its domain forever — a re-invocation never re-routes.
       const { mid, seq } = this.dealMid(domain);
-      // The write-source axes (§5.3): which physical source each write staged onto. All `"daemon"`
-      // in single-domain (Collapsed) — so the filter and hold-back below are inert on the live path.
-      const touchedSources = new Set(sources);
-      const writeSources = new Map<string, string>();
-      mergeWriteSources(writeSources, stagedKeys, sources);
-      this.pendingMutations.push({ mid, seq, name, args, domain, touched, writes, reads, touchedSources, writeSources });
+      this.pendingMutations.push({ mid, seq, name, args, domain, touched, writes, reads });
       // The prediction stuck — fold its child ops into the optimistic agg delta and push it onto
       // the `__agg` head rows (§4). No reset here (this is the §1.3 trivial case, no rewind): the
       // delta accumulates on top of the prior pending set, and `reconcileAggHead` recomputes each
@@ -1845,6 +1583,9 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     const foldKey = `${name}\0${stableJson(opts.key)}`;
     // One commit boundary spans the prediction AND the `__agg`-head reconcile (see {@link inOneCommit}),
     // so a folded mutation's list view and count view flush together, never torn across two commits.
+    // The declared domain (302 §5) — resolved up front, like `invoke`'s: it picks the staging
+    // map, the §9.3 cadence, and the provisional confirming stream (the flush re-resolves).
+    const domain = this.resolveDomain(name, args);
     return this.inOneCommit(() => {
       // Apply the prediction with the read trap armed (§5): a folded mutator that reads state to
       // compute its write is non-absorbing and refused. A throw discards the staged write (clean
@@ -1852,11 +1593,9 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
       // path stays byte-for-byte as it was; recording (§3.2 #2) never arms alongside the trap.
       const writes: WriteSet = new Map();
       const ops: ChildOp[] = [];
-      const stagedKeys: string[] = [];
-      let sources: string[] = [];
       try {
-        sources = this.local.writeWith((tx) => {
-          this.runMutator(mutator, trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), true, undefined, stagedKeys), args);
+        this.local.writeWith((tx) => {
+          this.runMutator(mutator, trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), true, undefined, this.stagingMap(domain)), args);
         });
       } catch (e) {
         if (e instanceof FoldReadError) {
@@ -1871,37 +1610,30 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
 
       // `touched` is DERIVED, never separately populated (§3.2 #1) — see {@link WriteSet}.
       const touched = new Set(writes.keys());
-      // The write-source axes (§5.3), like `touched`/`writes` — REPLACED wholesale on an in-place
-      // fold overwrite (the latest invocation supersedes, absorbing), initialized on a new entry.
-      const touchedSources = new Set(sources);
-      const writeSources = new Map<string, string>();
-      mergeWriteSources(writeSources, stagedKeys, sources);
+      this.warnCrossAuthorityWrites(name, domain, touched);
       const now = this.clock.now();
       let f = this.folds.get(foldKey);
       if (f) {
         // Overwrite the single entry in place — the pending stack does NOT grow (§1 #2). The head
         // already carries this new prediction (absorbing, last-wins on the cell); the entry holds
         // only the LATEST args, which is what a rebase re-derives from and what the flush ships.
+        // `domain` too: THIS invocation staged through the freshly-resolved domain's map above, so
+        // a mid-window rebase must re-stage through the same one (the flush re-resolves anyway;
+        // no mid is pinned yet — `entry.mid` is null until flush).
         f.entry.args = args;
         f.entry.touched = touched;
         f.entry.writes = writes;
-        f.entry.touchedSources = touchedSources;
-        f.entry.writeSources = writeSources;
+        f.entry.domain = domain;
         f.args = args;
         this.clock.clearTimeout(f.timer);
       } else {
-        // Provisional domain (§7.1): re-resolved from the final args/write-set at flush, when the
-        // mid is dealt. Never read before then — an un-flushed fold (`mid == null`) is
-        // unconditionally retained — so the full (counting) derivation deliberately does NOT run
-        // here (it would double-bump the Q6 counters for one logical route); the flush derives.
-        const domain = this.domainPolicy(name, args) ?? "daemon";
         // §9.3: pick the window's cadence. Routing into a room ⇒ flush at roomDebounceMs so
         // intermediates stream to the shared head; off the room, the caller's collapse debounce
-        // governs. The probe restores the Q6 diagnostics (the flush owns the authoritative bump).
-        const inRoom = opts.roomDebounceMs !== undefined && this.routesToRoom(name, args, writes);
+        // governs.
+        const inRoom = opts.roomDebounceMs !== undefined && domain !== "daemon";
         const debounceMs = inRoom ? opts.roomDebounceMs! : opts.debounceMs ?? DEFAULT_FOLD_DEBOUNCE_MS;
         const maxWaitMs = inRoom ? opts.roomDebounceMs! : opts.maxWaitMs;
-        const entry: PendingMutation = { mid: null, seq: null, name, args, domain, touched, writes, reads: { reads: [], queries: [] }, touchedSources, writeSources };
+        const entry: PendingMutation = { mid: null, seq: null, name, args, domain, touched, writes, reads: { reads: [], queries: [] } };
         this.pendingMutations.push(entry);
         let resolveMid!: (mid: number) => void;
         const midPromise = new Promise<number>((res) => (resolveMid = res));
@@ -1951,13 +1683,11 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     if (!f) return;
     this.clock.clearTimeout(f.timer);
     this.folds.delete(foldKey);
-    // Resolve the confirming stream from the FINAL args (§7.1) and deal the mid from that domain's
-    // ledger — SEND order, never reserved, so gapless within the domain. Under H-iii derivation
-    // this RE-DERIVES from the entry's LATEST write-set (each in-place fold overwrite replaced it,
-    // so it reflects the final absorbed value): same §3 rules minus reads — a fold's read-set is
-    // provably empty by construction (the FoldReadError trap, not recording, arms on that path),
-    // which is the STRONGEST read proof there is. The mid dealt below then pins this domain.
-    const domain = this.resolveDomain(f.entry.name, f.args, f.entry.writes, f.entry.reads);
+    // Re-resolve the DECLARED confirming stream from the FINAL args (§7.1) and deal the mid from
+    // that domain's ledger — SEND order, never reserved, so gapless within the domain. The mid
+    // dealt below then pins this domain. (A domain that changed since the window opened — a room
+    // attached or dropped mid-window — re-stages on the next reconcile's re-invocation.)
+    const domain = this.resolveDomain(f.entry.name, f.args);
     f.entry.domain = domain;
     const { mid, seq } = this.dealMid(domain);
     f.entry.mid = mid;
@@ -2076,8 +1806,7 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
       );
       return;
     }
-    // kind === "deopt": Q6's completion — how often a routed mutation came back refused.
-    this.routingReasons.set("deopt", (this.routingReasons.get("deopt") ?? 0) + 1);
+    // kind === "deopt": the room gate refused a declared-room mutation — re-enqueue onto the daemon.
     const entry = this.pendingMutations.find((p) => p.domain === domain && p.mid === frame.mid);
     if (entry) {
       entry.domain = "daemon";
@@ -2261,85 +1990,42 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     nextMid: Record<string, number>;
     watermark: Record<string, number>;
     /** Per connected CHANNEL (§5.1): its release watermark + buffered-frame depth — the axis the
-     *  gate-isolation assertions read (one source's laggy cvMin must never move the other's) —
-     *  plus the §301 upstream-absorption advert last recorded from its progress frames (a ROOM
-     *  gate with a new shell; absent otherwise). */
-    gates: Record<string, { appliedCv: number; bufferedFrames: number; upstreamCv?: number; upstreamBoot?: string }>;
-    /** The §3 router's counters (H-iii) — Q6's measurement hook: how often derivation succeeded
-     *  (per derived room) and why it fell to the daemon (per reason). See {@link RoutingInspect}
-     *  for the counting discipline (per-candidate failures; pins bump nothing). */
-    routing: RoutingInspect;
+     *  gate-isolation assertions read (one source's laggy cvMin must never move the other's). */
+    gates: Record<string, { appliedCv: number; bufferedFrames: number }>;
+    /** Per connected/registered room: its wire-table → engine-table map (302 §2) and which local
+     *  view qids are currently swapped onto it (302 §4). */
+    roomTables: Record<string, Record<string, string>>;
+    swappedViews: Record<number, string>;
     /** The §4 lifecycle plane's folded state (Slice I-iii introspection): the per-doc §4.2 fence
      *  value (`roomWatermarks`, I-v's ghost-drop input), the per-scope §4.1 occupancy map
      *  (`scopeSessions`: scope → client_id → expires_at, I-iv's doorbell input), and the live
-     *  I-v ghosts (demoted room sources still awaiting their fence). */
+     *  I-v ghosts (demoted room sources still awaiting their swap-back fence). */
     lifecycle: {
       roomWatermarks: Record<string, number>;
       scopeSessions: Record<string, Record<string, number>>;
-      ghosts: Record<string, { doc: string; finalFlushSeq: number; tables: string[] }>;
+      ghosts: Record<string, { doc: string; finalFlushSeq: number }>;
     };
-    /** The live §301 pin registry (`301-ECHO-FENCE-DESIGN.md` §2.5 — the devtools/Q6 surface):
-     *  every parked hold-back's fence inputs plus its tripwire state, keyed
-     *  `${table}\0${sourceKey}\0${pkKey}`. Pruned lazily, so an entry here may briefly outlive
-     *  its engine pin (never the reverse). */
-    pins: Record<
-      string,
-      {
-        table: string;
-        sourceKey: string;
-        domain: string;
-        mid: number;
-        daemonBoot?: string;
-        daemonCv?: number;
-        tripwired: boolean;
-      }
-    >;
-    /** The §301 direction-A fence map: per room domain, the highest DAEMON-CARRIED ledger lmid. */
-    daemonCarriedLmid: Record<string, number>;
-    pending: { mid: number | null; seq: number | null; name: string; domain: string; touchedSources: string[]; writeSources: Record<string, string> }[];
+    pending: { mid: number | null; seq: number | null; name: string; domain: string }[];
   } {
     return {
       nextMid: Object.fromEntries(this.nextMid),
       watermark: Object.fromEntries(this.watermark),
       gates: Object.fromEntries(
-        [...this.gates].map(([k, g]) => [
-          k,
-          {
-            appliedCv: g.appliedCv,
-            bufferedFrames: g.buffer.length,
-            ...(g.upstreamCv !== undefined ? { upstreamCv: g.upstreamCv } : {}),
-            ...(g.upstreamBoot !== undefined ? { upstreamBoot: g.upstreamBoot } : {}),
-          },
-        ]),
+        [...this.gates].map(([k, g]) => [k, { appliedCv: g.appliedCv, bufferedFrames: g.buffer.length }]),
       ),
-      routing: {
-        derived: Object.fromEntries(this.routingDerived),
-        reasons: Object.fromEntries(this.routingReasons),
-      },
+      roomTables: Object.fromEntries(
+        [...this.roomTables].map(([k, m]) => [k, Object.fromEntries(m)]),
+      ),
+      swappedViews: Object.fromEntries(this.roomSwappedViews),
       lifecycle: {
         roomWatermarks: Object.fromEntries(this.roomWatermarks),
         scopeSessions: Object.fromEntries(
           [...this.scopeSessions].map(([scope, sessions]) => [scope, Object.fromEntries(sessions)]),
         ),
         ghosts: Object.fromEntries(
-          [...this.ghosts].map(([k, g]) => [k, { doc: g.doc, finalFlushSeq: g.finalFlushSeq, tables: [...g.tables] }]),
+          [...this.ghosts].map(([k, g]) => [k, { doc: g.doc, finalFlushSeq: g.finalFlushSeq }]),
         ),
       },
-      pins: Object.fromEntries(
-        [...this.pins].map(([k, p]) => [
-          k,
-          {
-            table: p.table,
-            sourceKey: p.sourceKey,
-            domain: p.domain,
-            mid: p.mid,
-            ...(p.daemonBoot !== undefined ? { daemonBoot: p.daemonBoot } : {}),
-            ...(p.daemonCv !== undefined ? { daemonCv: p.daemonCv } : {}),
-            tripwired: p.tripwired === true,
-          },
-        ]),
-      ),
-      daemonCarriedLmid: Object.fromEntries(this.daemonCarriedLmid),
       pending: this.pendingMutations.map((p) => ({
         mid: p.mid,
         // The client-global deal sequence — the REPLAY order (mids are per-domain, incomparable
@@ -2347,11 +2033,6 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
         seq: p.seq,
         name: p.name,
         domain: p.domain,
-        // The write-source axes (§5.3): which physical source(s) this entry's writes routed onto —
-        // the filter basis, and (per pk) the hold-back's cross-slice test. The harness asserts the
-        // filter/routing against its independent model with these.
-        touchedSources: [...p.touchedSources],
-        writeSources: Object.fromEntries(p.writeSources),
       })),
     };
   }
@@ -2449,16 +2130,6 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
    *  delta, lmid → watermark) and {@link applyRelease} (per-source confirm-drop + reconcile) —
    *  N independent gates all feed the ONE apply half; {@link __testRelease} drives it directly. */
   private onGateProgress(gate: SourceGate, frame: ProgressFrame): void {
-    // §301 direction B: record the frame's upstream-absorption advert BEFORE the release applies,
-    // so the drop pass at applyRelease's tail evaluates exactly this release's advert — the room
-    // emits data-then-progress on one socket, so by the time the advert says "absorbed through
-    // cv U" the re-published echo data is in this release's fold (never ahead of it). Verbatim,
-    // not max-folded: on a daemon restart the advertised cv space legitimately resets and the
-    // §2.4 boot rule (not monotonicity) carries the ordering.
-    if (frame.upstreamCv !== undefined) {
-      gate.upstreamCv = frame.upstreamCv;
-      gate.upstreamBoot = frame.upstreamBoot;
-    }
     const { deltas, newlyHydrated, touchedScopes } = this.computeRelease(gate, frame);
     this.applyRelease(gate.key, deltas, undefined, newlyHydrated);
     // I-iv phase 2: a retargeted sub whose first ROOM snapshot released just now gets its old
@@ -2516,8 +2187,11 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
         this.foldLmidOps(f.ops, gate.key);
         continue;
       }
+      // A ROOM gate's deltas rename into the room's namespaced tables — and a wire table outside
+      // the registered map is DROPPED (302 §6: context comes from the daemon, one authority per
+      // table; a room's relayed context copy must never enter the store).
       muts.push(
-        ...(f.kind === "snapshot" ? gate.sync.rehydrate(f.qid, f.ops) : gate.sync.applyBatch(f.qid, f.ops)),
+        ...mapGateDeltas(gate, f.kind === "snapshot" ? gate.sync.rehydrate(f.qid, f.ops) : gate.sync.applyBatch(f.qid, f.ops)),
       );
       // A query's first released snapshot is its hydration point — even an empty one (0 rows is an
       // authoritative answer): lift every local view this sub feeds out of `unknown` (loading).
@@ -2547,38 +2221,6 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     if (watermarkUpdate !== undefined) {
       this.watermark.set(sourceKey, Math.max(this.watermark.get(sourceKey) ?? 0, watermarkUpdate));
     }
-    // Echo hold-back (§7.3), BEFORE the confirm-drop: an entry `p` this release CONFIRMS
-    // (`p.mid <= watermark[p.domain]`) but which staged a write onto a DIFFERENT source `S` (a
-    // cross-slice write — e.g. a room-domain mutation whose write routed to the daemon slice) is
-    // about to leave `pendingMutations`, so it will NOT be re-invoked on `S`'s next rewind. Park each
-    // such write inertly on `S` so that rewind (which un-applies the not-re-invoked write) does not
-    // flash-revert it. Two variants, one per write shape (G-i unified them engine-side):
-    //   - ADD/EDIT (`rec.row` present): pinned PRESENCE — drops when `S`'s confirmed baseline
-    //     value-matches (its echo lands — the E-i-tested drop).
-    //   - REMOVE (`rec.row === undefined`, G-iii): pinned ABSENCE — the §7.3 tombstone, parked with
-    //     the captured pre-image (`rec.oldRow`) so `S`'s rewind cannot resurrect the deleted row;
-    //     drops when `S`'s baseline lacks the pk (the delete echoed).
-    // Inert in single-domain: every write's source equals its domain.
-    for (const p of this.pendingMutations) {
-      if (p.mid === null || p.mid > (this.watermark.get(p.domain) ?? 0)) continue; // not confirmed now
-      for (const [table, byPk] of p.writes) {
-        // The Collapsed-park gate (G-iii): NEVER park on an un-promoted table. Inert-anyway today
-        // (`rewind_collapsed` never consults `held_back`), so skipping is behaviorally identical —
-        // but a stale Collapsed-era entry would become overlay-first-visible (a permanent pin) if
-        // the table later promotes. Slice H's prove-or-slow-path routing makes the real scenario
-        // (a room-confirmed mutation writing a Collapsed table) impossible; this covers until then.
-        if (!this.promotedTables.has(table)) continue;
-        for (const [pkKey, rec] of byPk) {
-          const s = p.writeSources.get(writeSourceKey(table, pkKey));
-          if (s === undefined || s === p.domain) continue; // same-slice: the rewind replays it
-          if (rec.row !== undefined) this.local.holdBack(table, s, rec.row);
-          else if (rec.oldRow !== undefined) this.local.holdBackAbsent(table, s, rec.oldRow);
-          else continue;
-          // §301 §2.1: register the pin's delivery-fence inputs in the same breath as the park.
-          this.registerPin(table, s, pkKey, rec.row ?? (rec.oldRow as WireValue[]), p);
-        }
-      }
-    }
     // Drop confirmed pending (§1.3 step 5's bookkeeping half), PER DOMAIN: an entry is retired only
     // when ITS domain's watermark reaches its mid — so two concurrent streams never alias one counter
     // (§7.1). A failed mutation drops the same way (the release carries no effects, so the rewind snaps
@@ -2627,11 +2269,11 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
       for (const qid of newlyHydrated) this.handler(qid, { type: "batch", events: [], catchUp: true });
     }
     this.refreshPending();
-    // The §301 echo-fence drop pass — strictly AFTER the reconcile above folded this release's
-    // data, so a fence that cleared in this release drops its pin only once the co-committed
-    // echo data is actually in the baseline (dropping earlier would itself reopen the flash
-    // window §7.3 closes). Structural no-op with no pins (every single-domain client).
-    this.dropEchoFencePins();
+    // The 302 §4.1 swap-in — strictly AFTER the reconcile above folded this release's data, so a
+    // room sub whose first snapshot just released swaps its views onto room tables that already
+    // hold the snapshot (swapping earlier would hydrate them empty). Structural no-op with no
+    // pending swap (every single-domain client).
+    this.processSwapIns();
     // The I-v ghost-drop watcher (§4.2), LAST: this release's watermark rows have folded
     // (computeRelease) and its confirm-drop has retired what it covers — exactly the two inputs
     // the drop condition reads. Structural no-op with no ghost.
@@ -2647,164 +2289,58 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
     this.applyRelease(sourceKey, deltas, watermarkUpdate);
   }
 
-  // --- the §301 echo fences (301-ECHO-FENCE-DESIGN.md) -----------------------------------
+  // --- the 302 §4 swap-in ------------------------------------------------------------------
 
-  /** Register (or overwrite — a later cross-slice confirm re-pinning the same slice-pk matches
-   *  the engine's `held_back.insert`) one {@link EchoFencePin}, in the same breath as the
-   *  engine park (§2.1). `p` is the confirmed entry whose write staged onto `sourceKey`; its
-   *  `mid` is non-null by the caller's confirm filter. */
-  private registerPin(
-    table: string,
-    sourceKey: string,
-    pkKey: string,
-    probeRow: WireValue[],
-    p: PendingMutation,
-  ): void {
-    const pin: EchoFencePin = {
-      table,
-      sourceKey,
-      probeRow,
-      domain: p.domain,
-      mid: p.mid as number,
-    };
-    if (sourceKey !== "daemon" && p.domain === "daemon") {
-      // Direction B stamps (§1.2): the parking daemon release's coherence position — the confirm
-      // folded at-or-before it, so a room advertising absorption ≥ this cv has absorbed the
-      // commit that carried the write — plus the client-observed boot it belongs to (§2.4).
-      pin.daemonCv = this.daemonGate.appliedCv;
-      if (this.daemonBootId !== undefined) pin.daemonBoot = this.daemonBootId;
-    }
-    // The tripwire reference (§2.5): the slice's confirmed-baseline row at park.
-    pin.baselineAtPark = this.local.heldBackState(table, sourceKey, probeRow)?.baseline as
-      | WireValue[]
-      | undefined;
-    this.pins.set(`${table}\0${sourceKey}\0${pkKey}`, pin);
-  }
-
-  /** The §2.3 drop pass, run at the tail of every applied release: prune registry entries whose
-   *  engine pin is already gone (the rewind's state-match fallback or a whole-source removal beat
-   *  the fence — benign), drop every pin whose fence cleared (one engine drop each, delivered on
-   *  the ordinary event stream, bracketed as ONE notification commit), and tripwire the rest. */
-  private dropEchoFencePins(): void {
-    if (this.pins.size === 0) return; // every single-domain client: structural no-op
-    let cleared: [string, EchoFencePin][] | null = null;
-    for (const [key, pin] of this.pins) {
-      const state = this.local.heldBackState(pin.table, pin.sourceKey, pin.probeRow);
-      if (state === undefined) {
-        this.pins.delete(key); // engine pin gone (state-match / source removal): lazy prune
-        continue;
-      }
-      if (this.pinFenceCleared(pin)) (cleared ??= []).push([key, pin]);
-      else this.maybeTripwirePin(key, pin, state.baseline as WireValue[] | undefined);
-    }
-    if (!cleared) return;
+  /** Swap every view of each just-hydrated ROOM sub onto the room's namespaced tables (302 §4.1):
+   *  re-register the local engine query with the AST's room-owned table references renamed
+   *  ({@link remapAstTables}); the Store folds the re-hello as an in-place reset, so the caller's
+   *  view reference survives and subscribers see ONE transition. Runs at the applyRelease tail —
+   *  the reconcile has already folded the sub's snapshot into the room tables, so the swapped
+   *  view hydrates straight to the room state (swapping earlier would flash it empty). The
+   *  ORIGINAL ast stays in {@link asts}; the swap-back ({@link dropGhost}) re-registers it.
+   *
+   *  This is the accepted-flash boundary (302 §4.1/§7.1): the room's copy may be behind the
+   *  daemon rows the view showed a moment ago — accepted by decision, revisit on a real
+   *  two-region deploy. */
+  private processSwapIns(): void {
+    if (this.pendingSwapIns.size === 0) return; // every single-domain release: structural no-op
+    const subs = [...this.pendingSwapIns];
+    this.pendingSwapIns.clear();
     this.inOneCommit(() => {
-      for (const [key, pin] of cleared) {
-        this.pins.delete(key);
-        this.local.dropHeldBack(pin.table, pin.sourceKey, pin.probeRow);
+      for (const sub of subs) {
+        const map = this.roomTables.get(sub.channel);
+        for (const qid of sub.localQids.keys()) {
+          const ast = this.asts.get(qid);
+          if (ast === undefined) continue;
+          // 302 §6.1 coverage check, BEFORE the owned-table gate (an all-context room swaps
+          // nothing yet still starves every ref): any referenced table the room does not own
+          // keeps reading the PLAIN daemon tables after the swap — legal (the client-side join
+          // across kinds), but the rows render only if a daemon subscription covers them, which
+          // is unknowable here. Surface once per view, loudly, so a silently-empty join is a
+          // named condition. Local-only tables are daemon-free by definition — skip them.
+          if (!this.contextJoinWarned.has(qid)) {
+            const uncovered = [...collectTables(ast)].filter((t) => !(map?.has(t) ?? false) && !this.localTables.has(t));
+            if (uncovered.length > 0) {
+              this.contextJoinWarned.add(qid);
+              this.roomContextJoinHandler({ sourceKey: sub.channel, name: sub.remote.name, args: sub.remote.args, tables: uncovered });
+            }
+          }
+          if (map === undefined || map.size === 0) continue; // no owned tables — nothing to swap
+          if (this.roomSwappedViews.get(qid) === sub.channel) continue; // already swapped
+          const rewritten = remapAstTables(this.plainEngineAst(ast), map);
+          this.local.unregisterQuery(qid);
+          this.local.registerQuery(qid, rewritten);
+          this.roomSwappedViews.set(qid, sub.channel);
+          // The pending axis follows the engine tables the view now reads (union — the wire
+          // names stay too, conservatively: a daemon-declared write to a room-visible table is
+          // still an honest "pending elsewhere" signal).
+          const tables = this.queryTables.get(qid);
+          if (tables) for (const t of map.values()) tables.add(t);
+        }
       }
     });
   }
 
-  /** Has `pin`'s delivery fence provably closed its confirm→echo window? (§2.3/§2.4.) */
-  private pinFenceCleared(pin: EchoFencePin): boolean {
-    if (pin.sourceKey === "daemon") {
-      // Direction A: the daemon-carried ledger for the confirming room domain covers the mid —
-      // the I-ii co-commit means this release (or an earlier one) folded the flush data that
-      // carried it into the daemon baseline (§1.1).
-      return (this.daemonCarriedLmid.get(pin.domain) ?? 0) >= pin.mid;
-    }
-    // Direction B: only a daemon-confirmed write has the daemon-cv stamp; a room-staged pin
-    // confirmed by ANOTHER room (outside today's two-tier topology) has no fence.
-    if (pin.daemonCv === undefined) return false;
-    const gate = this.gates.get(pin.sourceKey);
-    if (!gate || gate.upstreamCv === undefined) return false; // no advert (old shell): §2.5 fallback
-    if (gate.upstreamBoot === pin.daemonBoot) return gate.upstreamCv >= pin.daemonCv;
-    // Boot mismatch (§2.4): a boot the client has OBSERVED as later proves absorption (the
-    // room's post-restart re-snapshot came from daemon state that durably includes the
-    // confirmed write); an unknown/older/unstamped boot holds — conservative, its next
-    // re-snapshot advances it.
-    if (pin.daemonBoot === undefined || gate.upstreamBoot === undefined) return false;
-    const pinOrd = this.daemonBootOrdinals.get(pin.daemonBoot);
-    const advOrd = this.daemonBootOrdinals.get(gate.upstreamBoot);
-    return pinOrd !== undefined && advOrd !== undefined && advOrd > pinOrd;
-  }
-
-  /** The §2.5 stuck-pin tripwire, in the scopesHash spirit: log ONCE per pin when its slice's
-   *  baseline row has CHANGED VALUE since park while the pin still holds — the suspicious state
-   *  that precedes every forever-pin (a fence-less pairing, a fence bug). Never drops anything. */
-  private maybeTripwirePin(key: string, pin: EchoFencePin, baseline: WireValue[] | undefined): void {
-    if (pin.tripwired) return;
-    const same =
-      pin.baselineAtPark === undefined || baseline === undefined
-        ? pin.baselineAtPark === baseline
-        : pin.baselineAtPark.length === baseline.length &&
-          pin.baselineAtPark.every((c, i) => identicalCell(c, baseline[i]));
-    if (same) return;
-    pin.tripwired = true;
-    const [table, sourceKey, pkKey] = key.split("\0");
-    console.warn(
-      `rindle: a §7.3 hold-back pin on table "${table}" slice "${sourceKey}" pk ${pkKey} (confirming domain ${pin.domain}, mid ${pin.mid}) is parked while its slice's baseline moved past it — if this client never converges on that row, this pin is why (301-ECHO-FENCE-DESIGN.md §2.5).`,
-    );
-  }
-
-  /** Record one observed daemon boot id (§2.4): first observation of an id assigns the next
-   *  ordinal (the client's own total order over opaque boot ids); every call refreshes the
-   *  current-boot stamp for direction-B parks. */
-  private observeDaemonBoot(bootId: string): void {
-    if (!this.daemonBootOrdinals.has(bootId)) {
-      this.daemonBootOrdinals.set(bootId, this.daemonBootOrdinals.size);
-    }
-    this.daemonBootId = bootId;
-  }
-
-  /** Promote `table` to a MERGED multi-source engine with room `sourceKey`'s per-row writable
-   *  scope (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §5.2) — THE one promotion seam. The engine
-   *  attach and the {@link promotedTables} record move in the same breath: the §7.3 hold-back
-   *  trigger in {@link applyRelease} parks ONLY on promoted tables, so a promotion that bypassed
-   *  the record would silently disable the echo hold-back for that table (and a record without the
-   *  engine attach would park onto a slice that doesn't exist). Recorded AFTER the engine accepts —
-   *  a rejected descriptor/table must not leave a phantom promotion. Slice G-v's client drives this
-   *  from the lease's `realtime.tables` (`RoomTableSpec` → {@link WritableDescriptor}); idempotence
-   *  per `(sourceKey, table)` is the CALLER's job (the engine refuses a duplicate room).
-   *
-   *  `spec` (H-iii) is the per-table ROUTING spec riding the same lease table block — recorded
-   *  into {@link roomRouting} (THE routing table the §3 router reads) in the same breath, with
-   *  `writable` derived from the descriptor's kind (`none` = a context table the room may not
-   *  write). Omitted (the E-iii-b harness alias below) ⇒ an empty spec: no join keys to guard, no
-   *  `footprintWhere` (that room's reads then fail closed to the daemon unless self/room-served). */
-  promoteRoomTable(
-    table: string,
-    sourceKey: string,
-    writable: WritableDescriptor,
-    spec?: RoomTableRoutingSpec,
-  ): void {
-    this.local.addRoomSource(table, sourceKey, writable);
-    this.promotedTables.add(table);
-    let byTable = this.roomRouting.get(sourceKey);
-    if (!byTable) this.roomRouting.set(sourceKey, (byTable = new Map()));
-    byTable.set(table, {
-      writable: writable.kind !== "none",
-      joinKeyCols: [...(spec?.joinKeyCols ?? [])],
-      ...(spec?.where !== undefined ? { where: spec.where } : {}),
-      ...(spec?.footprintWhere !== undefined ? { footprintWhere: spec.footprintWhere } : {}),
-    });
-  }
-
-  /** The recorded routing specs for `sourceKey`'s promoted tables (table → its
-   *  {@link RoomTableRouting}) — read-only: the client's `__realtimeInspect`/idempotence
-   *  bookkeeping reads THIS record instead of keeping its own shadow copy (one source of truth).
-   *  Empty map when the room has promoted nothing. */
-  roomTablesFor(sourceKey: string): ReadonlyMap<string, RoomTableRouting> {
-    return this.roomRouting.get(sourceKey) ?? EMPTY_ROUTING;
-  }
-
-  /** Test-named alias of {@link promoteRoomTable} (E-iii-b scaffolding — the multi-domain oracle
-   *  and per-source-gate suites drive it). Pure delegation: ONE body, one `promotedTables` record. */
-  __addRoomSource(table: string, roomKey: string, writable: WritableDescriptor, spec?: RoomTableRoutingSpec): void {
-    this.promoteRoomTable(table, roomKey, writable, spec);
-  }
-
   /** Fold `domain`'s lmid system query's released ops (lmid-as-data): the one row's
    *  `last_mutation_id` cell is this client's confirmed high-water mid in that domain — it advances
    *  `watermark[domain]` and, on a fresh session ahead of our issued mids, `nextMid[domain]`. The
@@ -2935,16 +2471,7 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
         const [doc, clientId, lmid] = cells;
         if (typeof doc !== "string" || clientId !== this.clientID) continue;
         if (spec.doc !== undefined && doc !== spec.doc) continue;
-        const covered = Number(lmid);
-        this.foldConfirm(roomDomainKey(doc), covered);
-        // The §301 direction-A fence input: the DAEMON-CARRIED ledger fold ALONE (the room
-        // socket's own lmid stream confirms long before the flush reaches the daemon, so it
-        // folds the shared watermark above but never this map — 301 §1.1). Max-fold: ledger
-        // rows re-deliver across re-hydrates.
-        if (Number.isFinite(covered)) {
-          const dom = roomDomainKey(doc);
-          this.daemonCarriedLmid.set(dom, Math.max(this.daemonCarriedLmid.get(dom) ?? 0, covered));
-        }
+        this.foldConfirm(roomDomainKey(doc), Number(lmid));
       }
     }
     // (3) watermark rows → the monotone §4.2 fence value per doc.
@@ -3023,58 +2550,53 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
    *  deliver the coalesced result (`serverBatchEnd`). This is the engine's only sync-moving
    *  boundary — `onProgress` releases and `unregisterQuery`'s GC both go through here so head
    *  and sync never diverge (the §1.2 invariant; CRIT#2). */
-  private runReconcileCycle(sourceKey: string, serverDeltas: Mutation[]): void {
-    // `sourceKey` names the authority these `deltas` confirm — `"daemon"` on the live daemon path (and
-    // the GC path), a `room:doc:X` string on a per-source release (E-iii). It selects which physical
-    // source the wasm engine's rewind folds the delta into (`Db::serverBatchBegin`). The E-iii-b/c
-    // per-source rewind + intersecting-pending re-invoke filter ride the same seam later.
-    this.local.serverBatchBegin(sourceKey, serverDeltas.map(toServerOp));
-    // The aggregate overlay (§4) is DAEMON-tracked: its `__agg_*` tables are server-authoritative
-    // synthetic tables that only the daemon feed drives. A room cycle must not wipe or rebuild it
-    // (that would double-count / lose daemon agg state), so gate every overlay interaction — reset,
-    // observe, and reconcileAggHead — on the daemon cycle. Single-domain: always daemon ⇒ unchanged.
-    const daemonCycle = sourceKey === "daemon";
-    if (daemonCycle) {
-      // The rewind cleared every optimistic write — incl. prior `__agg` edits — so head is now the
-      // server baseline. Rebuild the optimistic agg delta from scratch off the re-invoked
-      // (confirm-filtered) pending set, so a just-confirmed mutation's delta vanishes exactly as its
-      // server count is absorbed (§5 watermark — no double count).
-      this.overlay.reset();
-    }
+  private runReconcileCycle(_sourceKey: string, serverDeltas: Mutation[]): void {
+    // `_sourceKey` names the authority these `deltas` confirm — `"daemon"` on the live daemon
+    // path (and the GC path), a `room:doc:X` string on a room release, whose deltas already carry
+    // the room's ENGINE table names (the gate's rename/filter). Kept for call-site readability
+    // and tracing only: the engine itself is source-agnostic (302: one authority per table) — its
+    // rewind covers EVERY tracked table and every pending mutation re-invokes below regardless of
+    // which channel released, so NOTHING in this cycle may branch on it.
+    this.local.serverBatchBegin(serverDeltas.map(toServerOp));
+    // The rewind covers EVERY tracked table (302: the engine is source-agnostic — there is no
+    // per-source rewind) — including the `__agg_*` head rows — whichever channel released. So the
+    // optimistic agg delta rebuilds on EVERY cycle, room or daemon: reset here, re-observe from
+    // the re-invoked pending set below, re-apply onto the rewound heads at the end. Gating any of
+    // the three on a daemon-only cycle (the pre-302 per-source-rewind contract) would let a room
+    // release wipe the optimistic `__agg` edits and skip the rebuild — every count() view snaps
+    // back to the server base until the next daemon release. The delta stays sound across
+    // domains: `reconcileAggHead` recomputes each head as the absolute `server_base ⊕ delta`,
+    // and the server base (`this.sync`) only moves on daemon releases.
+    this.overlay.reset();
     // Sort ALL pending into SEND order (the client-global `seq` ascending, then unflushed folds
     // last by creation order — the deterministic §4.1 slot; the comparator is explicit, NOT
-    // `(seq ?? ∞) - (seq ?? ∞)` which is `∞ - ∞ = NaN` and corrupts V8's sort), THEN FILTER to the
-    // writers of THIS source (§5.3): a per-source rewind un-applied ONLY that source's staged
-    // writes, so ONLY those must re-invoke — the others' predictions are intact on their un-rewound
-    // trees. The key MUST be `seq`, never `mid`: mids are per-domain (§7.1) so mids from different
-    // domains are incomparable — a mid-sort would replay a room mid 1 before a daemon mid 5 that
-    // was sent FIRST, letting a read-dependent mutator re-predict from a base it never saw
-    // (confirmation order is per-domain; replay order is client-global). FILTERING the
-    // globally-ordered array preserves the relative send order among the subset (the 200 §4.1
-    // invariant); NEVER re-sort the subset. Single-domain: every entry has
-    // `touchedSources = {"daemon"}` and seq order == mid order (except H-v deopt re-enqueues,
-    // which keep their ORIGINAL seq under a later daemon mid — deliberately, so this very sort
-    // replays them at their original overlay position) ⇒ byte-identical to before.
-    const order = [...this.pendingMutations]
-      .sort((a, b) => {
-        if (a.seq === null && b.seq === null) return 0; // both unflushed → stable creation order
-        if (a.seq === null) return 1; // an unflushed fold sorts after every dealt seq
-        if (b.seq === null) return -1;
-        return a.seq - b.seq;
-      })
-      .filter((p) => p.touchedSources.has(sourceKey));
+    // `(seq ?? ∞) - (seq ?? ∞)` which is `∞ - ∞ = NaN` and corrupts V8's sort). The key MUST be
+    // `seq`, never `mid`: mids are per-domain (§7.1) so mids from different domains are
+    // incomparable — a mid-sort would replay a room mid 1 before a daemon mid 5 that was sent
+    // FIRST, letting a read-dependent mutator re-predict from a base it never saw (confirmation
+    // order is per-domain; replay order is client-global). EVERY entry re-invokes — the engine's
+    // rewind covers every tracked table (302: there is no per-source rewind), so every entry's
+    // staged writes were just un-applied, whichever channel released. Single-domain: seq order ==
+    // mid order (except H-v deopt re-enqueues, which keep their ORIGINAL seq under a later daemon
+    // mid — deliberately, so this very sort replays them at their original overlay position).
+    const order = [...this.pendingMutations].sort((a, b) => {
+      if (a.seq === null && b.seq === null) return 0; // both unflushed → stable creation order
+      if (a.seq === null) return 1; // an unflushed fold sorts after every dealt seq
+      if (b.seq === null) return -1;
+      return a.seq - b.seq;
+    });
     const dropped = new Set<PendingMutation>();
     try {
       for (const p of order) {
         // NO `readLog` here — recording is armed only on the initial `invoke` (§3.2 #2 note on
         // `PendingMutation.reads`); a re-invocation's write-set still needs fresh capture (below).
+        // The staging map follows the entry's CURRENT domain — a deopt-flipped or re-routed entry
+        // re-stages onto its new domain's tables here.
         const writes: WriteSet = new Map();
         const ops: ChildOp[] = [];
-        const stagedKeys: string[] = [];
-        let sources: string[] = [];
         try {
-          sources = this.local.writeWith((tx) => {
-            this.runMutator(this.registry[p.name], trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, undefined, stagedKeys), p.args);
+          this.local.writeWith((tx) => {
+            this.runMutator(this.registry[p.name], trackingTx(tx, writes, this.specs, this.localTables, this.opCollector(ops), false, undefined, this.stagingMap(p.domain)), p.args);
           });
         } catch {
           // A re-invocation threw — e.g. a read-dependent mutator whose base row the server
@@ -3086,25 +2608,20 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
           dropped.add(p);
           continue;
         }
-        // The re-invocation stuck — fold its child ops into the rebuilt optimistic agg delta (daemon
-        // cycle only — a room cycle leaves the daemon-tracked overlay untouched).
-        if (daemonCycle) for (const op of ops) this.overlay.observe(op);
+        // The re-invocation stuck — fold its child ops into the rebuilt optimistic agg delta.
+        for (const op of ops) this.overlay.observe(op);
         // The pending footprint is the UNION across invocations: a re-run that no-ops (touched =
         // {}) must NOT shrink it, else a still-pending mutation reports not-pending and its
-        // pending-axis clear fires early (§7.2). `writes`/the source axes mirror this: merge, never
-        // replace. (A re-invocation may route differently, e.g. onto a source the room feed now
-        // holds — union so the filter still catches it on either source's next cycle.)
+        // pending-axis clear fires early (§7.2). `writes` mirrors this: merge, never replace.
         for (const t of writes.keys()) p.touched.add(t);
         mergeWriteSet(p.writes, writes);
-        for (const s of sources) p.touchedSources.add(s);
-        mergeWriteSources(p.writeSources, stagedKeys, sources);
       }
       // Preserve creation order in the live array (the unflushed-fold sort tiebreak depends on it).
       if (dropped.size) this.pendingMutations = this.pendingMutations.filter((p) => !dropped.has(p));
       // Re-apply the optimistic agg delta onto the (rewound) `__agg` head rows — INSIDE the open
       // cycle, so the writes buffer and coalesce into the one per-query delivery `serverBatchEnd`
-      // makes (and never escape as a separate batch). Daemon cycle only (see above).
-      if (daemonCycle) this.reconcileAggHead();
+      // makes (and never escape as a separate batch). Every cycle (see the reset above).
+      this.reconcileAggHead();
     } finally {
       this.local.serverBatchEnd(); // ALWAYS close the cycle — ONE delivery per affected query.
     }
@@ -3121,10 +2638,6 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
   private resetGate(gate: SourceGate): void {
     gate.buffer = [];
     gate.appliedCv = 0;
-    // The §301 upstream-absorption advert dies with the incarnation that made it — the fresh
-    // one re-advertises (direction-B pins conservatively hold until it does).
-    delete gate.upstreamBoot;
-    delete gate.upstreamCv;
   }
 
   /** The §8.5 escape: ONE gate's buffer outgrew its cap (a pinned `cvMin` under churn on that
@@ -3160,14 +2673,17 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
   }
 
   /** A remote sub's first snapshot landed: mark it (and every local view it feeds) hydrated, then
-   *  lift those views out of `unknown` (loading). Idempotent — a re-hydrate snapshot re-marks
-   *  harmlessly; a source qid with no sub (the lmid system query) is a no-op. */
+   *  lift those views out of `unknown` (loading). A ROOM sub's hydration additionally queues the
+   *  302 §4.1 swap-in — performed at the applyRelease TAIL ({@link processSwapIns}), once the
+   *  reconcile has folded this snapshot into the room tables. Idempotent — a re-hydrate snapshot
+   *  re-marks harmlessly; a source qid with no sub (the lmid system query) is a no-op. */
   private markSubHydrated(sourceQid: QueryId): void {
     const key = this.sourceToRemote.get(sourceQid);
     if (!key) return;
     const sub = this.remoteSubs.get(key);
     if (!sub || sub.hydrated) return;
     sub.hydrated = true;
+    if (sub.channel !== "daemon" && !this.systemQids.has(sub.sourceQid)) this.pendingSwapIns.add(sub);
     for (const localQid of sub.localQids.keys()) {
       this.hydrated.add(localQid);
       this.recomputeResultType(localQid);
@@ -3205,9 +2721,31 @@ export class OptimisticBackend<S extends ColsMap> implements Backend {
       // A late-joiner to an already-hydrated sub is immediately hydrated; otherwise this view now
       // awaits the sub's first snapshot (so a split-path local view registered `complete` flips to
       // `unknown` here). Then recompute its lifecycle.
-      if (sub.hydrated) this.hydrated.add(localQueryId);
-      else this.hydrated.delete(localQueryId);
-      this.recomputeResultType(localQueryId);
+      if (sub.hydrated) {
+        this.hydrated.add(localQueryId);
+        // 302 §4.1 LATE JOIN: a ROOM sub's one-shot swap queue ({@link markSubHydrated}) fired at
+        // its first released snapshot — long gone by now — so a view attaching afterwards must
+        // swap onto the room's namespaced tables HERE, or its engine query stays registered on
+        // the plain daemon tables the room channel never feeds (empty/stale, reported complete,
+        // diverging from its already-swapped siblings forever). The room tables already hold the
+        // released state (hydrated ⇒ folded), so swapping immediately is the ordinary
+        // after-the-data order; processSwapIns skips already-swapped siblings, and
+        // pendingSwapIns is empty outside a release, so exactly this sub's un-swapped views move.
+        if (sub.channel !== "daemon" && !this.systemQids.has(sub.sourceQid)) {
+          this.pendingSwapIns.add(sub);
+          this.processSwapIns();
+        }
+        // FORCE the notify past setResultType's dedup: the labeled split registers the local
+        // half `complete`, then flips the STORE view to `unknown` for the lease window WITHOUT
+        // touching our record — so a complete→complete recompute here would swallow the event
+        // and strand the late-joining view `unknown` forever. Redundant notifies are idempotent
+        // Store-side; a swallowed transition is not recoverable.
+        this.resultTypes.set(localQueryId, "complete");
+        this.resultTypeHandler(localQueryId, "complete");
+      } else {
+        this.hydrated.delete(localQueryId);
+        this.recomputeResultType(localQueryId);
+      }
     }
     this.localToRemote.set(retainQid, key);
     this.remoteRetainToLocal.set(retainQid, localQueryId);
@@ -3346,103 +2884,53 @@ function mergeWriteSet(dest: WriteSet, src: WriteSet): void {
   }
 }
 
-/** The key a per-pk write source is stored under in {@link PendingMutation.writeSources}: `table`
- *  + NUL + the pk-key (`stableJson(pk)`). NUL appears in neither a table name nor `stableJson`
- *  output, so it is an unambiguous separator — the same key the confirm-drop hold-back reconstructs
- *  from `(table, pkKey)` while iterating `writes`. */
-function writeSourceKey(table: string, pkKey: string): string {
-  return `${table}\u0000${pkKey}`;
-}
-
-/** Zip the staged-order per-write source keys (`stagedKeys`, from `trackingTx`) with the staged-order
- *  `sources[]` (`commitTracked`) into `dest`, last-write-per-key winning (§5.3). Never shrinks `dest`
- *  — a rebase re-invocation MERGES its fresh routing in, mirroring {@link mergeWriteSet}. The two
- *  arrays align 1:1: `trackingTx` pushes exactly one key per staged change, and `commitTracked`
- *  returns one source per staged change, both in staged order. */
-function mergeWriteSources(dest: Map<string, string>, stagedKeys: string[], sources: string[]): void {
-  const n = Math.min(stagedKeys.length, sources.length);
-  for (let i = 0; i < n; i++) dest.set(stagedKeys[i], sources[i]);
-}
-
-// --- the §3 router's pure helpers (H-iii) --------------------------------------------
+// --- the 302 room-table helpers -------------------------------------------------------
 
-/** STRICT cell identity for the join-key no-change rule (§3 write rule #3): `===`, nothing more —
- *  no coercion, no deep equality (a non-primitive join-key cell compares by reference and thus
- *  conservatively fails), `NaN !== NaN` conservatively fails. Failing closed here only costs a
- *  daemon route. */
-function identicalCell(a: WireValue, b: WireValue): boolean {
-  return a === b;
+/** The namespaced ENGINE table backing wire `table` for room `sourceKey` (302 §2: `room_deck` ≠
+ *  `deck` — one authority per table). `@` appears in no schema table name — ENFORCED by
+ *  `createSchema`/`extendSchema`'s addTableMeta ban (packages/client/src/schema.ts), so the name
+ *  cannot collide with a real table. */
+export function roomEngineTable(table: string, sourceKey: string): string {
+  return `${table}@${sourceKey}`;
 }
 
-/** Whether `cond` is decidable from the KEY ALONE: every column it references — collected from
- *  BOTH operand positions (under-counting could over-claim decidability; over-counting only fails
- *  closed — the H-iv-a discipline) — is a pk column. A `correlatedSubquery` is never key-local. */
-// Exported for test/predicate_agreement.test.ts — the TS corner of the cross-evaluator
-// agreement corpus (rust/rindle-room-core/tests/fixtures/predicate-agreement.json). NOT part of
-// the package surface (index.ts curates exports); the corpus is the drift tripwire that keeps
-// this evaluator honest against the engine + room-gate pair it shares no code with.
-export function keyDecidable(cond: Condition, pkCols: ReadonlySet<string>): boolean {
-  switch (cond.type) {
-    case "simple": {
-      if (cond.left.type === "column" && !pkCols.has(cond.left.name)) return false;
-      if (cond.right.type === "column" && !pkCols.has(cond.right.name)) return false;
-      return true;
-    }
-    case "and":
-    case "or":
-      return cond.conditions.every((c) => keyDecidable(c, pkCols));
-    case "correlatedSubquery":
-      return false;
+/** Rename a room gate's released deltas into the room's namespaced tables, DROPPING deltas for
+ *  wire tables outside the map (context / unknown — the daemon is their sole authority, 302 §6).
+ *  Identity (no copy) for a map-less gate — the daemon path is untouched. */
+function mapGateDeltas(gate: SourceGate, muts: Mutation[]): Mutation[] {
+  const map = gate.tableMap;
+  if (map === undefined) return muts;
+  const out: Mutation[] = [];
+  for (const m of muts) {
+    const engineTable = map.get(m.table);
+    if (engineTable === undefined) continue;
+    out.push({ ...m, table: engineTable });
   }
+  return out;
 }
 
-/** Evaluate a key-decidable `footprintWhere` on a read's pk cells — H-iii's ONE client-side
- *  non-engine evaluator, DELIBERATELY MINIMAL (the TS evaluation caveat on the router block
- *  comment): `simple` `=`/`!=` between a pk COLUMN and a same-primitive-type NON-NULL literal,
- *  composed under and/or. The empty AND — the compiler's vacuous-true emission for an exact
- *  unconstrained footprint root — evaluates `true` (load-bearing: whole-table footprints keep
- *  provable reads); the empty OR is vacuous-false. Returns `undefined` = NOT EVALUABLE for
- *  anything else (other ops, null on either side, cross-type comparisons, column-vs-column,
- *  literal-vs-literal, non-primitive cells, correlated subqueries) — the caller fails to the
- *  daemon. A non-evaluable node anywhere poisons the whole tree (no short-circuit past it):
- *  partial evaluation could otherwise claim a verdict the engine's semantics might contradict. */
-// Exported for test/predicate_agreement.test.ts (see keyDecidable's note above).
-export function evalFootprintOnPk(cond: Condition, pkCells: ReadonlyMap<string, WireValue>): boolean | undefined {
-  switch (cond.type) {
-    case "simple": {
-      if (cond.op !== "=" && cond.op !== "!=") return undefined;
-      const col = cond.left.type === "column" ? cond.left : cond.right.type === "column" ? cond.right : undefined;
-      const lit = cond.left.type === "literal" ? cond.left : cond.right.type === "literal" ? cond.right : undefined;
-      if (col === undefined || lit === undefined) return undefined; // column-vs-column / literal-vs-literal
-      if (!pkCells.has(col.name)) return undefined; // not a pk column (keyDecidable pre-screens)
-      const cell = pkCells.get(col.name);
-      const value = lit.value;
-      if (cell === null || value === null) return undefined; // no null semantics client-side
-      if (typeof cell !== typeof value) return undefined; // no cross-type comparison semantics
-      if (typeof cell !== "string" && typeof cell !== "number" && typeof cell !== "boolean") return undefined;
-      return cond.op === "=" ? cell === value : cell !== value;
-    }
-    case "and": {
-      let out = true;
-      for (const c of cond.conditions) {
-        const v = evalFootprintOnPk(c, pkCells);
-        if (v === undefined) return undefined;
-        out = out && v;
-      }
-      return out;
-    }
-    case "or": {
-      let out = false;
-      for (const c of cond.conditions) {
-        const v = evalFootprintOnPk(c, pkCells);
-        if (v === undefined) return undefined;
-        out = out || v;
-      }
-      return out;
-    }
-    case "correlatedSubquery":
-      return undefined;
-  }
+/** Rename every TABLE reference in a query AST through `map` (302 §2 point 3 — the room-homed
+ *  view's rewrite): the root `table`, every `related` subquery, every `correlatedSubquery`
+ *  (EXISTS) condition — walking the KNOWN wire-AST shape, never a blind key scan: `start.row` is
+ *  keyed by COLUMN name (a schema column literally named `table` must keep its bound value), and
+ *  the same goes for any future column-keyed record. Tables absent from the map keep their name —
+ *  that is the client-side join across kinds (a room table joined to daemon-owned context,
+ *  201-style). Structural clone; the input AST is never mutated. */
+export function remapAstTables(ast: Ast, map: ReadonlyMap<string, string>): Ast {
+  const walkCond = (c: Condition): Condition => {
+    if (c.type === "and" || c.type === "or") return { ...c, conditions: c.conditions.map(walkCond) };
+    if (c.type === "correlatedSubquery") return { ...c, related: walkSub(c.related) };
+    return c; // "simple" — column refs and literals carry no table reference
+  };
+  const walkSub = (s: CorrelatedSubquery): CorrelatedSubquery => ({ ...s, subquery: walk(s.subquery) });
+  const walk = (a: Ast): Ast => ({
+    ...a,
+    table: map.get(a.table) ?? a.table,
+    ...(a.where !== undefined ? { where: walkCond(a.where) } : {}),
+    ...(a.having !== undefined ? { having: walkCond(a.having) } : {}),
+    ...(a.related !== undefined ? { related: a.related.map(walkSub) } : {}),
+  });
+  return walk(ast);
 }
 
 /** Wrap the raw wasm txn as the client `MutationTx`, capturing a pk-granular write-set as it
@@ -3490,17 +2978,21 @@ function trackingTx(
   onOp?: (op: ChildOp) => void,
   trapReads = false,
   readLog?: ReadLog,
-  stagedKeys?: string[],
-  /** Per-read provenance probe (H-ii §3.2 #3): called once per RECORDED present read with the
-   *  full-width row the read observed; meaningful only alongside `readLog` (never consulted when
-   *  recording is off — the fold and replay paths pass neither). */
-  provenance?: (table: string, row: WireValue[]) => string | undefined,
+  /** The 302 staging map for a room-DECLARED mutation: wire table → the room's namespaced engine
+   *  table for the tables the room owns; identity for everything else. Every raw engine access —
+   *  reads and writes — goes through it, so a room mutator reads/writes the room's own state
+   *  (its optimistic effects land where the room-homed views look) while its envelope still
+   *  ships the wire names. Absent (or a non-owned table) ⇒ the plain table, verbatim. */
+  stage?: ReadonlyMap<string, string>,
 ): MutationTx {
   const spec = (table: string) => {
     const s = specs[table];
     if (!s) throw new Error(`unknown table ${JSON.stringify(table)} — tables: ${Object.keys(specs).join(", ")}`);
     return s;
   };
+  /** The ENGINE table a wire-named access lands on (302 §2). Schema/column validation always
+   *  runs on the WIRE name (the namespaced twin shares the spec). */
+  const staged = (table: string): string => stage?.get(table) ?? table;
 
   // M1 (`201-LOCAL-ONLY-TABLES-DESIGN.md` §6): a replayable mutator is a pure function of
   // (synced base + args) — it neither READS nor WRITES a local-only table. The server runs the
@@ -3546,17 +3038,15 @@ function trackingTx(
   // this invocation — an add-then-edit (or edit-then-edit) of the same pk collapses to its final
   // image, matching the engine head's own semantics for that pk. The record is replaced with
   // exactly the arguments given: the CALLERS (`edit`/`remove` below, consulting `prior`) decide
-  // the pre-image per the H-ii coalescing matrix on {@link WriteRecord}.
-  const recordWrite = (table: string, pk: WireValue[], row: WireValue[] | undefined, oldRow?: WireValue[]): void => {
-    let byPk = writes.get(table);
-    if (!byPk) writes.set(table, (byPk = new Map()));
+  // the pre-image per the H-ii coalescing matrix on {@link WriteRecord}. Keyed by the STAGED
+  // (engine) table name, so the pending axis and the write-set match what the engine holds.
+  const recordWrite = (engineTable: string, pk: WireValue[], row: WireValue[] | undefined, oldRow?: WireValue[]): void => {
+    let byPk = writes.get(engineTable);
+    if (!byPk) writes.set(engineTable, (byPk = new Map()));
     const pkKey = stableJson(pk);
     // Defensive copies: the wasm binding's returned arrays are not contractually immutable/unique,
     // so a captured record must not alias a cell array the engine could later reuse or mutate.
-    byPk.set(pkKey, { table, pk: [...pk], row: row ? [...row] : undefined, ...(oldRow ? { oldRow: [...oldRow] } : {}) });
-    // Staged-order key trace (§5.3): pushed once per staged change, so it zips 1:1 with the staged
-    // order of `commitTracked`'s `sources[]` — letting the caller learn each write's routed source.
-    stagedKeys?.push(writeSourceKey(table, pkKey));
+    byPk.set(pkKey, { table: engineTable, pk: [...pk], row: row ? [...row] : undefined, ...(oldRow ? { oldRow: [...oldRow] } : {}) });
   };
 
   // A full insert row: each cell is `obj[c]`, or `null` for an omitted nullable column (design 206
@@ -3587,22 +3077,17 @@ function trackingTx(
   // trapped path (where `readLog` is never armed) records nothing, exactly as before.
   const rawGet = (table: string, pk: WireValue[]) => {
     assertNotLocal(table, "read");
-    return tx.get(table, pk) as WireValue[] | undefined;
+    return tx.get(staged(table), pk) as WireValue[] | undefined;
   };
 
   // Push one {@link ReadRecord} when recording is armed (§3.2 #2/#3): outcome from `row`'s
-  // presence, per-read provenance probed with the observed FULL-WIDTH row — present reads only
-  // (an absent read has no row to probe with, and records no source; see {@link ReadRecord}).
-  // The `source` key is OMITTED (not set to undefined) when there is no answer, so a
-  // single-domain record is byte-identical to Slice B's.
+  // presence. Pure capture for inspection.
   const recordRead = (table: string, pk: WireValue[], row: WireValue[] | undefined): void => {
     if (!readLog) return;
-    const source = row === undefined ? undefined : provenance?.(table, row);
     readLog.reads.push({
       table,
       pk: [...pk],
       outcome: row === undefined ? "absent" : "present",
-      ...(source !== undefined ? { source } : {}),
     });
   };
 
@@ -3625,38 +3110,43 @@ function trackingTx(
   };
 
   // The pk's existing record from THIS invocation, if any — the coalescing-matrix input for
-  // `edit`/`remove` below (see {@link WriteRecord}).
+  // `edit`/`remove` below (see {@link WriteRecord}). Keyed by the STAGED name like the records.
   const prior = (table: string, pk: WireValue[]): WriteRecord | undefined =>
-    writes.get(table)?.get(stableJson(pk));
+    writes.get(staged(table))?.get(stableJson(pk));
   const add = (table: string, row: WireValue[]) => {
     assertNotLocal(table, "write");
-    recordWrite(table, pkFromCells(table, row), row);
+    const t = staged(table);
+    recordWrite(t, pkFromCells(table, row), row);
+    // ChildOps carry the WIRE name (unlike the write-set): the agg overlay's defs are keyed by
+    // the ORIGINAL AST's child tables (`collectAggDefs`), and the `__agg_*` heads it feeds are
+    // shared by plain and swapped views alike — a staged name would silently miss the dispatch
+    // and the optimistic count would lag every room-declared write until its echo.
     onOp?.({ table, kind: "add", row });
-    tx.add(table, row);
+    tx.add(t, row);
   };
   const remove = (table: string, row: WireValue[]) => {
     assertNotLocal(table, "write");
+    const t = staged(table);
     const pk = pkFromCells(table, row);
-    // The remove PRE-IMAGE (G-iii, §7.3 tombstone; the H-ii matrix on {@link WriteRecord}):
-    // remove-after-edit/-remove keeps the ORIGINAL captured pre-image (the txn-entry base — the
-    // net effect is a remove of the row the external world last knew, never the edited transient).
-    // Otherwise (first touch, or remove-after-add) the truthful full-width row is the txn-visible
-    // one — `tx.get` read BEFORE the remove stages (read-your-writes: an add of this pk earlier in
-    // the SAME invocation shows through). Captured NOW so Slice H's writable-predicate evaluation
-    // over it needs no migration. Falls back to the caller's asserted `row` when the pk is not
+    // The remove PRE-IMAGE (the H-ii matrix on {@link WriteRecord}): remove-after-edit/-remove
+    // keeps the ORIGINAL captured pre-image (the txn-entry base — the net effect is a remove of
+    // the row the external world last knew, never the edited transient). Otherwise (first touch,
+    // or remove-after-add) the truthful full-width row is the txn-visible one — `tx.get` read
+    // BEFORE the remove stages (read-your-writes: an add of this pk earlier in the SAME
+    // invocation shows through). Falls back to the caller's asserted `row` when the pk is not
     // resident (a raw remove of an absent row) — a captured remove thus always carries a
-    // full-width pre-image (the engine width-checks `holdBackAbsent`).
-    const oldRow = prior(table, pk)?.oldRow ?? (tx.get(table, pk) as WireValue[] | undefined) ?? row;
-    recordWrite(table, pk, undefined, oldRow);
-    onOp?.({ table, kind: "remove", row });
-    tx.remove(table, row);
+    // full-width pre-image.
+    const oldRow = prior(table, pk)?.oldRow ?? (tx.get(t, pk) as WireValue[] | undefined) ?? row;
+    recordWrite(t, pk, undefined, oldRow);
+    onOp?.({ table, kind: "remove", row }); // wire name — see `add`
+    tx.remove(t, row);
   };
   const edit = (table: string, oldRow: WireValue[], newRow: WireValue[]) => {
     assertNotLocal(table, "write");
+    const t = staged(table);
     const pk = pkFromCells(table, newRow);
-    // The edit PRE-IMAGE (H-ii; the matrix on {@link WriteRecord}) — H-iii's join-key no-change
-    // input, and the row the engine routes the Edit by (H-i). First touch: the txn-visible row
-    // read BEFORE staging, falling back to the caller's asserted `oldRow` when the pk is not
+    // The edit PRE-IMAGE (the H-ii matrix on {@link WriteRecord}). First touch: the txn-visible
+    // row read BEFORE staging, falling back to the caller's asserted `oldRow` when the pk is not
     // resident (covers the pk-MOVING raw edit — the record is keyed by the NEW pk; the pre-image
     // carries the OLD row). Edit-after-edit: keep the FIRST pre-image (the txn-entry base).
     // Edit-after-add / edit-after-remove: the record collapses to a (re-)insert — NO pre-image
@@ -3664,13 +3154,13 @@ function trackingTx(
     const p = prior(table, pk);
     const pre =
       p === undefined
-        ? ((tx.get(table, pk) as WireValue[] | undefined) ?? oldRow)
+        ? ((tx.get(t, pk) as WireValue[] | undefined) ?? oldRow)
         : p.row !== undefined && p.oldRow !== undefined
           ? p.oldRow
           : undefined;
-    recordWrite(table, pk, newRow, pre);
-    onOp?.({ table, kind: "edit", row: newRow, old: oldRow });
-    tx.edit(table, oldRow, newRow);
+    recordWrite(t, pk, newRow, pre);
+    onOp?.({ table, kind: "edit", row: newRow, old: oldRow }); // wire name — see `add`
+    tx.edit(t, oldRow, newRow);
   };
 
   // The folded read trap (§5): a mutator that reads to compute its write is refused. `() => never`
@@ -3688,7 +3178,9 @@ function trackingTx(
     const ast = q.ast();
     for (const t of collectTables(ast)) assertNotLocal(t, "read");
     readLog?.queries.push(ast);
-    return tx.query(ast) as QueryResultRow[];
+    // A room-declared mutator's one-shot query reads the room's own staged state for the tables
+    // the room owns (the same staging rule as the point reads above).
+    return tx.query(stage !== undefined && stage.size > 0 ? remapAstTables(ast, stage) : ast) as QueryResultRow[];
   };
 
   return {
@@ -3762,4 +3254,3 @@ function intersects(a: Set<string>, b: Set<string>): boolean {
   for (const x of b) if (a.has(x)) return true;
   return false;
 }
-