@rindle/wasm 0.4.4 → 0.5.0

package/dist/index.d.ts

@@ -1,6 +1,29 @@
 import { Store } from "@rindle/client";
-import type { Ast, Backend, ChangeEvent, ColsMap, Mutation, QueryId, Schema } from "@rindle/client";
+import type { Ast, Backend, ChangeEvent, ColsMap, Condition, Mutation, QueryId, Schema } from "@rindle/client";
 export * from "@rindle/client";
+/** A serializable writable-scope descriptor: how the merge decides, per row, whether an attached
+ *  room may write it (the room copy then wins, RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §5.2).
+ *  `"all"` = the room owns every row it holds; `"none"` = a context table the daemon stays
+ *  authoritative for; `"colEq"` = writable iff `row[col] === value` (harness stand-in). The REAL
+ *  shape (Slice G) is `"predicate"`: `where` is the SAME wire {@link Condition} JSON a query AST
+ *  carries, restricted to what evaluates against a single row — `simple` column-vs-literal leaves
+ *  under `and`/`or`; a `correlatedSubquery` (or any other non-row-local node) is rejected loudly at
+ *  `addRoomSource` time. It compiles Rust-side through the engine's OWN filter lowering
+ *  (`create_predicate`), so writable evaluation can never disagree with query-filter semantics.
+ *  NOTE: room join-key columns (Slice H) deliberately do NOT cross this boundary — they stay
+ *  TS-side. */
+export type WritableDescriptor = {
+    kind: "all";
+} | {
+    kind: "none";
+} | {
+    kind: "colEq";
+    col: number;
+    value: unknown;
+} | {
+    kind: "predicate";
+    where: Condition;
+};
 /** A raw staged write transaction over the wasm engine — the surface an optimistic client
  *  mutator runs against (`get` reads the live state under this txn's staged overlay, so a
  *  read-dependent mutator sees its own writes; OPTIMISTIC-WRITES-DESIGN.md §4.1). */
@@ -19,6 +42,17 @@ export interface WasmWriteTxn {
         queryId: number;
         events: unknown[];
     }>;
+    /** Like {@link commit}, additionally returning the per-change touched-source key list in staged
+     *  order (`sources`, e.g. `"daemon"` / `"room:doc:1"`) — the provenance each staged write routed
+     *  through, captured pre-apply (Slice E-iii-b, design Q1). `batches` is exactly {@link commit}'s
+     *  return; the source list is additive. */
+    commitTracked(): {
+        batches: Array<{
+            queryId: number;
+            events: unknown[];
+        }>;
+        sources: string[];
+    };
     rollback(): void;
 }
 /** One base-table row op of a coherent server delta (the §1.3 `D`), bare cells. */
@@ -98,18 +132,80 @@ export declare class WasmBackend<S extends ColsMap> implements Backend {
      *  `onCommitted` runs after `tx.commit()` returns but before `dispatch` delivers to
      *  subscribers: a throw from `f` (pre-commit — engine untouched) skips it; a subscriber
      *  throw re-raised by `dispatch` happens after it. It is the only point where "the commit
-     *  is applied" is knowable to a caller that must not confuse the two failure modes. */
-    writeWith(f: (tx: WasmWriteTxn) => void, onCommitted?: () => void): void;
-    /** Open a §1.3 reconcile cycle against the coherent server delta: the engine rewinds
-     *  (optimistic layer un-applied, delta folded in, `sync` re-forked) and starts
-     *  buffering. Re-invoke the still-pending mutators via {@link writeWith}, then call
-     *  {@link serverBatchEnd}. On error the optimistic state is poisoned — discard the
-     *  backend and re-hydrate. */
-    serverBatchBegin(deltas: ServerDeltaOp[]): void;
+     *  is applied" is knowable to a caller that must not confuse the two failure modes.
+     *
+     *  Returns the per-change **touched-source key list** in staged-write order (`"daemon"` /
+     *  `"room:doc:X"`, Slice E-iii-b design Q1) — additive; every current caller (`mutate`,
+     *  `writeLocal`, `@rindle/optimistic`) ignores it. The per-source reconcile (Slice E-iii-c) zips
+     *  it with the mutation's write-set for the per-pk hold-back source. */
+    writeWith(f: (tx: WasmWriteTxn) => void, onCommitted?: () => void): string[];
+    /** Open a §1.3 reconcile cycle against the coherent server delta: the engine rewinds the
+     *  per-source rebase (optimistic layer un-applied, delta folded in, the source's baseline
+     *  re-forked) and starts buffering. `sourceKey` names the authority the delta confirms —
+     *  `"daemon"` today (single-domain); a `room:doc:X` key once the room feed lands. Re-invoke the
+     *  still-pending mutators via {@link writeWith}, then call {@link serverBatchEnd}. On error the
+     *  rebase state is poisoned — discard the backend and re-hydrate. */
+    serverBatchBegin(sourceKey: string, deltas: ServerDeltaOp[]): void;
     /** Close the cycle: the whole buffered stream (rewind + re-invocations) coalesces to
      *  the minimal net per query (§3 — a confirmed-correct prediction delivers nothing)
      *  and dispatches as ONE batch per affected query on the ordinary event stream. */
     serverBatchEnd(): void;
+    /** Attach a room source to `table`, compiling `writable` into the merge's per-row writable scope.
+     *  Promotes the table Collapsed → Merged on the first room (§5.2); the room seeds empty, so no
+     *  visible blip. Throws on an untracked (local-only) table or a duplicate room. */
+    addRoomSource(table: string, roomKey: string, writable: WritableDescriptor): void;
+    /** Detach a room source, emitting the compensating visible deltas on the ordinary event stream. */
+    removeRoomSource(table: string, roomKey: string): void;
+    /** Park an echoed `row` inertly on `sourceKey`'s slice of `table` (the confirm→echo hold-back
+     *  window, design §7.3): keeps the row visible so the next per-source rewind of `sourceKey` does
+     *  not flash-revert a confirmed-elsewhere write before its data echo lands. `sourceKey` is
+     *  `"daemon"` or a `"room:doc:X"` key. */
+    holdBack(table: string, sourceKey: string, row: unknown[]): void;
+    /** Park `oldRow`'s pk as ABSENT on `sourceKey`'s slice of `table` — the §7.3 tombstone, the
+     *  remove-sibling of {@link holdBack} (Slice G-ii): a confirmed cross-slice REMOVE whose delete
+     *  echo has not landed on `sourceKey` must not resurrect through that source's next rewind. The
+     *  overlay masks the pk (overlay-first) until the source's re-forked baseline lacks it (the
+     *  delete echoed), then drops. `oldRow` is the full-width PRE-IMAGE row (same positional
+     *  bare-cell marshaling as {@link holdBack}); it carries the pk and, later (Slice H), the cells
+     *  writable-scope predicates evaluate on. */
+    holdBackAbsent(table: string, sourceKey: string, oldRow: unknown[]): void;
+    /** Drop one parked §7.3 hold-back at `probe`'s pk on `sourceKey`'s slice and reconcile the
+     *  pk's visible winner — the §301 FENCE-driven drop (`301-ECHO-FENCE-DESIGN.md` §2.2), fired
+     *  by the optimistic backend's pin registry once `sourceKey`'s stream has provably delivered
+     *  through the pinned write's commit. Unlike the park-time seams (whose install is a no-op by
+     *  construction) a drop is exactly the moment a masked authoritative row becomes visible, so
+     *  the engine's compensating deltas are DELIVERED here: dispatched on the ordinary event
+     *  stream (or folded into an open server-batch cycle's one delivery). No-op when nothing is
+     *  parked at the pk — the rewind's state-match fallback may have raced it. */
+    dropHeldBack(table: string, sourceKey: string, probe: unknown[]): void;
+    /** The parked hold-back at `probe`'s pk on `sourceKey`'s slice, or `undefined` (§301
+     *  introspection): `absent` names the tombstone variant; `baseline` is the source's CURRENT
+     *  confirmed-baseline row at the pk (`undefined` when the baseline lacks it) — the pin
+     *  registry's lazy-prune probe and the §2.5 stuck-pin tripwire input. Non-throwing on an
+     *  unknown source (a removed room), so pruning after a whole-source removal just works. */
+    heldBackState(table: string, sourceKey: string, probe: unknown[]): {
+        absent: boolean;
+        baseline: unknown[] | undefined;
+    } | undefined;
+    /** Freeze a physical source — the D4 downgrade-ghost stub (wins-if-present in the merge). */
+    freezeSource(table: string, sourceKey: string): void;
+    /** The source currently serving `row`'s pk on `table` — `"daemon"`, a room key, or `undefined`
+     *  when no source holds the pk (Slice H-i routing probe #1, design §3.2 #3). `row` is a
+     *  full-width positional row (the pk derives from it — same marshaling as {@link holdBack});
+     *  an unknown table throws loudly. Reads the LIVE visible state, overlay-first (§7.3): an open
+     *  write txn's staged-but-uncommitted rows are NOT consulted (they have not routed yet), which
+     *  is exactly the pre-commit view the §3 routing proof decides on — a present read is proven
+     *  room-covered iff this reports the occupied room. */
+    provenanceOf(table: string, row: unknown[]): string | undefined;
+    /** Evaluate the REGISTERED writable scope of `table`'s room source `roomKey` against a
+     *  caller-supplied full-width row (Slice H-i routing probe #2, design §3.1): a prediction-run
+     *  write is proven room-covered iff this is `true` on the written row. Runs the SAME compiled
+     *  predicate the merge's winner tiering uses (the {@link WritableDescriptor} registered at
+     *  {@link addRoomSource}), so routing can never disagree with the engine; `all` ⇒ always true,
+     *  `none` ⇒ always false, and a frozen source still answers (the predicate is static). Throws
+     *  loudly on an unknown table, a room key not attached to the table, a wrong-width row, or
+     *  `"daemon"` (which has no writable scope). */
+    writableMatches(table: string, roomKey: string, row: unknown[]): boolean;
 }
 /** Convenience: init the wasm + return a ready local {@link Store}. */
 export declare function createWasmStore<S extends ColsMap>(schema: Schema<S>): Promise<Store<S>>;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAmB,KAAK,EAAa,MAAM,gBAAgB,CAAC;AACnE,OAAO,KAAK,EACV,GAAG,EACH,OAAO,EACP,WAAW,EACX,OAAO,EACP,QAAQ,EACR,OAAO,EACP,MAAM,EACP,MAAM,gBAAgB,CAAC;AAExB,cAAc,gBAAgB,CAAC;AAa/B;;qFAEqF;AACrF,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC;IACzD;;;;6DAIyD;IACzD,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,EAAE,CAAC;IAC3B,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD,QAAQ,IAAI,IAAI,CAAC;CAClB;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,OAAO,EAAE,CAAA;CAAE,GAC9C;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,OAAO,EAAE,CAAA;CAAE,GACjD;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,EAAE,CAAC;IAAC,GAAG,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC;AAIpE;;sGAEsG;AACtG,wBAAgB,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9D;AAMD,qBAAa,WAAW,CAAC,CAAC,SAAS,OAAO,CAAE,YAAW,OAAO;IAC5D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAS;IAC5B,OAAO,CAAC,OAAO,CAAqD;IAKpE,OAAO,CAAC,eAAe,CAA8C;IACrE;gGAC4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAM1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkB;IAChD,OAAO,CAAC,QAAQ,CAAS;gBAEb,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAU7B;;;;qGAIiG;IACjG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI;IAIpF;;;;uEAImE;IACnE,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,WAAW,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI;IAejE;;;iGAG6F;IAC7F,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAInC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI;IAM3C,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;IAInC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5C,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI;IAI/D;;gDAE4C;IAC5C,gBAAgB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,KAAK,IAAI,GAAG,IAAI;IAIjE;;;;;;;;;;oGAUgG;IAChG,OAAO,CAAC,QAAQ;IA4ChB;;;;;;;;2FAQuF;IACvF,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI;IAQxE;;;;kCAI8B;IAC9B,gBAAgB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI;IAI/C;;uFAEmF;IACnF,cAAc,IAAI,IAAI;CAGvB;AAED,uEAAuE;AACvE,wBAAsB,eAAe,CAAC,CAAC,SAAS,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAG7F"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAmB,KAAK,EAAa,MAAM,gBAAgB,CAAC;AACnE,OAAO,KAAK,EACV,GAAG,EACH,OAAO,EACP,WAAW,EACX,OAAO,EACP,SAAS,EACT,QAAQ,EACR,OAAO,EACP,MAAM,EACP,MAAM,gBAAgB,CAAC;AAExB,cAAc,gBAAgB,CAAC;AAE/B;;;;;;;;;;eAUe;AACf,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AA4B5C;;qFAEqF;AACrF,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC;IACzD;;;;6DAIyD;IACzD,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,EAAE,CAAC;IAC3B,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD;;;+CAG2C;IAC3C,aAAa,IAAI;QAAE,OAAO,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,EAAE,CAAA;SAAE,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/F,QAAQ,IAAI,IAAI,CAAC;CAClB;AAED,mFAAmF;AACnF,MAAM,MAAM,aAAa,GACrB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,OAAO,EAAE,CAAA;CAAE,GAC9C;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,OAAO,EAAE,CAAA;CAAE,GACjD;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,EAAE,CAAC;IAAC,GAAG,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC;AAIpE;;sGAEsG;AACtG,wBAAgB,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9D;AAMD,qBAAa,WAAW,CAAC,CAAC,SAAS,OAAO,CAAE,YAAW,OAAO;IAC5D,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAS;IAC5B,OAAO,CAAC,OAAO,CAAqD;IAKpE,OAAO,CAAC,eAAe,CAA8C;IACrE;gGAC4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAM1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAkB;IAChD,OAAO,CAAC,QAAQ,CAAS;gBAEb,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAU7B;;;;qGAIiG;IACjG,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI;IAIpF;;;;uEAImE;IACnE,UAAU,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,WAAW,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI;IAejE;;;iGAG6F;IAC7F,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAInC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI;IAM3C,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;IAInC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAW5C,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI;IAI/D;;gDAE4C;IAC5C,gBAAgB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,KAAK,IAAI,GAAG,IAAI;IAIjE;;;;;;;;;;oGAUgG;IAChG,OAAO,CAAC,QAAQ;IA4ChB;;;;;;;;;;;;;4EAawE;IACxE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,IAAI,GAAG,MAAM,EAAE;IAS5E;;;;;yEAKqE;IACrE,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI;IAIlE;;uFAEmF;IACnF,cAAc,IAAI,IAAI;IAYtB;;uFAEmF;IACnF,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAIjF,mGAAmG;IACnG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAItD;;;8CAG0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI;IAIhE;;;;;;iDAM6C;IAC7C,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI;IAIzE;;;;;;;kFAO8E;IAC9E,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI;IAItE;;;;+FAI2F;IAC3F,aAAa,CACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,EAAE,GACf;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS;IAInE,6FAA6F;IAC7F,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAIpD;;;;;;2DAMuD;IACvD,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,SAAS;IAI/D;;;;;;;oDAOgD;IAChD,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO;CAGzE;AAED,uEAAuE;AACvE,wBAAsB,eAAe,CAAC,CAAC,SAAS,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAG7F"}

package/dist/index.js

@@ -191,21 +191,28 @@ export class WasmBackend {
      *  `onCommitted` runs after `tx.commit()` returns but before `dispatch` delivers to
      *  subscribers: a throw from `f` (pre-commit — engine untouched) skips it; a subscriber
      *  throw re-raised by `dispatch` happens after it. It is the only point where "the commit
-     *  is applied" is knowable to a caller that must not confuse the two failure modes. */
+     *  is applied" is knowable to a caller that must not confuse the two failure modes.
+     *
+     *  Returns the per-change **touched-source key list** in staged-write order (`"daemon"` /
+     *  `"room:doc:X"`, Slice E-iii-b design Q1) — additive; every current caller (`mutate`,
+     *  `writeLocal`, `@rindle/optimistic`) ignores it. The per-source reconcile (Slice E-iii-c) zips
+     *  it with the mutation's write-set for the per-pk hold-back source. */
     writeWith(f, onCommitted) {
         const tx = this.db.write();
         f(tx);
-        const batches = tx.commit();
+        const { batches, sources } = tx.commitTracked();
         onCommitted?.();
         this.dispatch(batches);
+        return sources;
     }
-    /** Open a §1.3 reconcile cycle against the coherent server delta: the engine rewinds
-     *  (optimistic layer un-applied, delta folded in, `sync` re-forked) and starts
-     *  buffering. Re-invoke the still-pending mutators via {@link writeWith}, then call
-     *  {@link serverBatchEnd}. On error the optimistic state is poisoned — discard the
-     *  backend and re-hydrate. */
-    serverBatchBegin(deltas) {
-        this.db.serverBatchBegin(deltas);
+    /** Open a §1.3 reconcile cycle against the coherent server delta: the engine rewinds the
+     *  per-source rebase (optimistic layer un-applied, delta folded in, the source's baseline
+     *  re-forked) and starts buffering. `sourceKey` names the authority the delta confirms —
+     *  `"daemon"` today (single-domain); a `room:doc:X` key once the room feed lands. Re-invoke the
+     *  still-pending mutators via {@link writeWith}, then call {@link serverBatchEnd}. On error the
+     *  rebase state is poisoned — discard the backend and re-hydrate. */
+    serverBatchBegin(sourceKey, deltas) {
+        this.db.serverBatchBegin(sourceKey, deltas);
     }
     /** Close the cycle: the whole buffered stream (rewind + re-invocations) coalesces to
      *  the minimal net per query (§3 — a confirmed-correct prediction delivers nothing)
@@ -213,6 +220,84 @@ export class WasmBackend {
     serverBatchEnd() {
         this.dispatch(this.db.serverBatchEnd());
     }
+    // --- multi-source seams (Slice E-iii-b harness → Slice G-ii ABI) ------------------
+    //
+    // Thin pass-throughs to the engine's `Merge` (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §5).
+    // `addRoomSource`'s {@link WritableDescriptor} now carries the real row-local `predicate` arm
+    // (a wire-Condition `where`, compiled Rust-side through the engine's own filter lowering)
+    // alongside the narrow `all`/`none`/`colEq` harness shapes. Single-domain behavior is untouched
+    // unless `addRoomSource` is called (a table stays Collapsed = today's daemon-only path).
+    /** Attach a room source to `table`, compiling `writable` into the merge's per-row writable scope.
+     *  Promotes the table Collapsed → Merged on the first room (§5.2); the room seeds empty, so no
+     *  visible blip. Throws on an untracked (local-only) table or a duplicate room. */
+    addRoomSource(table, roomKey, writable) {
+        this.db.addRoomSource(table, roomKey, writable);
+    }
+    /** Detach a room source, emitting the compensating visible deltas on the ordinary event stream. */
+    removeRoomSource(table, roomKey) {
+        this.db.removeRoomSource(table, roomKey);
+    }
+    /** Park an echoed `row` inertly on `sourceKey`'s slice of `table` (the confirm→echo hold-back
+     *  window, design §7.3): keeps the row visible so the next per-source rewind of `sourceKey` does
+     *  not flash-revert a confirmed-elsewhere write before its data echo lands. `sourceKey` is
+     *  `"daemon"` or a `"room:doc:X"` key. */
+    holdBack(table, sourceKey, row) {
+        this.db.holdBack(table, sourceKey, row);
+    }
+    /** Park `oldRow`'s pk as ABSENT on `sourceKey`'s slice of `table` — the §7.3 tombstone, the
+     *  remove-sibling of {@link holdBack} (Slice G-ii): a confirmed cross-slice REMOVE whose delete
+     *  echo has not landed on `sourceKey` must not resurrect through that source's next rewind. The
+     *  overlay masks the pk (overlay-first) until the source's re-forked baseline lacks it (the
+     *  delete echoed), then drops. `oldRow` is the full-width PRE-IMAGE row (same positional
+     *  bare-cell marshaling as {@link holdBack}); it carries the pk and, later (Slice H), the cells
+     *  writable-scope predicates evaluate on. */
+    holdBackAbsent(table, sourceKey, oldRow) {
+        this.db.holdBackAbsent(table, sourceKey, oldRow);
+    }
+    /** Drop one parked §7.3 hold-back at `probe`'s pk on `sourceKey`'s slice and reconcile the
+     *  pk's visible winner — the §301 FENCE-driven drop (`301-ECHO-FENCE-DESIGN.md` §2.2), fired
+     *  by the optimistic backend's pin registry once `sourceKey`'s stream has provably delivered
+     *  through the pinned write's commit. Unlike the park-time seams (whose install is a no-op by
+     *  construction) a drop is exactly the moment a masked authoritative row becomes visible, so
+     *  the engine's compensating deltas are DELIVERED here: dispatched on the ordinary event
+     *  stream (or folded into an open server-batch cycle's one delivery). No-op when nothing is
+     *  parked at the pk — the rewind's state-match fallback may have raced it. */
+    dropHeldBack(table, sourceKey, probe) {
+        this.dispatch(this.db.dropHeldBack(table, sourceKey, probe));
+    }
+    /** The parked hold-back at `probe`'s pk on `sourceKey`'s slice, or `undefined` (§301
+     *  introspection): `absent` names the tombstone variant; `baseline` is the source's CURRENT
+     *  confirmed-baseline row at the pk (`undefined` when the baseline lacks it) — the pin
+     *  registry's lazy-prune probe and the §2.5 stuck-pin tripwire input. Non-throwing on an
+     *  unknown source (a removed room), so pruning after a whole-source removal just works. */
+    heldBackState(table, sourceKey, probe) {
+        return this.db.heldBackState(table, sourceKey, probe);
+    }
+    /** Freeze a physical source — the D4 downgrade-ghost stub (wins-if-present in the merge). */
+    freezeSource(table, sourceKey) {
+        this.db.freezeSource(table, sourceKey);
+    }
+    /** The source currently serving `row`'s pk on `table` — `"daemon"`, a room key, or `undefined`
+     *  when no source holds the pk (Slice H-i routing probe #1, design §3.2 #3). `row` is a
+     *  full-width positional row (the pk derives from it — same marshaling as {@link holdBack});
+     *  an unknown table throws loudly. Reads the LIVE visible state, overlay-first (§7.3): an open
+     *  write txn's staged-but-uncommitted rows are NOT consulted (they have not routed yet), which
+     *  is exactly the pre-commit view the §3 routing proof decides on — a present read is proven
+     *  room-covered iff this reports the occupied room. */
+    provenanceOf(table, row) {
+        return this.db.provenanceOf(table, row);
+    }
+    /** Evaluate the REGISTERED writable scope of `table`'s room source `roomKey` against a
+     *  caller-supplied full-width row (Slice H-i routing probe #2, design §3.1): a prediction-run
+     *  write is proven room-covered iff this is `true` on the written row. Runs the SAME compiled
+     *  predicate the merge's winner tiering uses (the {@link WritableDescriptor} registered at
+     *  {@link addRoomSource}), so routing can never disagree with the engine; `all` ⇒ always true,
+     *  `none` ⇒ always false, and a frozen source still answers (the predicate is static). Throws
+     *  loudly on an unknown table, a room key not attached to the table, a wrong-width row, or
+     *  `"daemon"` (which has no writable scope). */
+    writableMatches(table, roomKey, row) {
+        return this.db.writableMatches(table, roomKey, row);
+    }
 }
 /** Convenience: init the wasm + return a ready local {@link Store}. */
 export async function createWasmStore(schema) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,kGAAkG;AAClG,6CAA6C;AAC7C,EAAE;AACF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AAEzF,OAAO,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAWnE,cAAc,gBAAgB,CAAC;AAqC/B,IAAI,WAAW,GAAyB,IAAI,CAAC;AAE7C;;sGAEsG;AACtG,MAAM,UAAU,QAAQ,CAAC,YAAsB;IAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;YACxB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAK,UAA6D,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAClG,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChF,MAAM,IAAI,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,EAAE,CAAC;YACf,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAMD,MAAM,OAAO,WAAW;IACL,EAAE,CAAS;IACpB,OAAO,GAA4C,GAAG,EAAE,GAAE,CAAC,CAAC;IACpE,8FAA8F;IAC9F,8FAA8F;IAC9F,gGAAgG;IAChG,qFAAqF;IAC7E,eAAe,GAAqC,GAAG,EAAE,GAAE,CAAC,CAAC;IACrE;gGAC4F;IAC3E,WAAW,CAAc;IAE1C,yFAAyF;IACzF,6FAA6F;IAC7F,8FAA8F;IAC9F,kBAAkB;IACD,aAAa,GAAe,EAAE,CAAC;IACxC,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAY,MAAiB;QAC3B,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,EAAuB,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,2FAA2F;YAC3F,8BAA8B;YAC9B,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED;;;;qGAIiG;IACjG,aAAa,CAAC,IAAY,EAAE,IAAiD;QAC3E,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;;;uEAImE;IACnE,UAAU,CAAC,SAAqB,EAAE,WAAwB;QACxD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,KAAK,8FAA8F,CAAC,CAAC;YAC/I,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE;YACpB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK;oBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;qBACtC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;oBAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;;oBACjD,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;QACH,CAAC,EAAE,WAAW,CAAC,CAAC;IAClB,CAAC;IAED;;;iGAG6F;IAC7F,eAAe,CAAC,IAAY;QAC1B,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,aAAa,CAAC,GAAY,EAAE,GAAQ;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAe,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,QAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,eAAe,CAAC,GAAY;QAC1B,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,SAAqB;QAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK;gBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;iBACtC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;gBAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;;gBACjD,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAc,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,CAAC,OAAgD;QACtD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;gDAE4C;IAC5C,gBAAgB,CAAC,OAAyC;QACxD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,CAAC;IAED;;;;;;;;;;oGAUgG;IACxF,QAAQ,CAAC,OAAiB;QAChC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,sDAAsD;QACjF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,UAAmB,CAAC;QACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,EAAE;YAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,UAAU,GAAG,GAAG,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAG,CAAC;gBACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS,CAAC,yDAAyD;gBAC1F,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAC9B,IAAI,CAAC;oBACH,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;wBACrB,IAAI,CAAC;4BACH,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAe,EAAE,CAAC,CAAC;wBACxE,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,CAAC,GAAG,CAAC,CAAC;wBACZ,CAAC;oBACH,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC;wBACH,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,gDAAgD;oBAC/E,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,CAAC,GAAG,CAAC,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,QAAQ;YAAE,MAAM,UAAU,CAAC;IACjC,CAAC;IAED,qFAAqF;IACrF,EAAE;IACF,qFAAqF;IACrF,qCAAqC;IAErC;;;;;;;;2FAQuF;IACvF,SAAS,CAAC,CAA6B,EAAE,WAAwB;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC,EAAE,CAAC,CAAC;QACN,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,EAAc,CAAC;QACxC,WAAW,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED;;;;kCAI8B;IAC9B,gBAAgB,CAAC,MAAuB;QACtC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED;;uFAEmF;IACnF,cAAc;QACZ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,EAAc,CAAC,CAAC;IACtD,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAoB,MAAiB;IACxE,MAAM,QAAQ,EAAE,CAAC;IACjB,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,kGAAkG;AAClG,6CAA6C;AAC7C,EAAE;AACF,yFAAyF;AACzF,yFAAyF;AACzF,yFAAyF;AAEzF,OAAO,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAYnE,cAAc,gBAAgB,CAAC;AA0E/B,IAAI,WAAW,GAAyB,IAAI,CAAC;AAE7C;;sGAEsG;AACtG,MAAM,UAAU,QAAQ,CAAC,YAAsB;IAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;YACxB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAK,UAA6D,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAClG,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChF,MAAM,IAAI,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,EAAE,CAAC;YACf,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAMD,MAAM,OAAO,WAAW;IACL,EAAE,CAAS;IACpB,OAAO,GAA4C,GAAG,EAAE,GAAE,CAAC,CAAC;IACpE,8FAA8F;IAC9F,8FAA8F;IAC9F,gGAAgG;IAChG,qFAAqF;IAC7E,eAAe,GAAqC,GAAG,EAAE,GAAE,CAAC,CAAC;IACrE;gGAC4F;IAC3E,WAAW,CAAc;IAE1C,yFAAyF;IACzF,6FAA6F;IAC7F,8FAA8F;IAC9F,kBAAkB;IACD,aAAa,GAAe,EAAE,CAAC;IACxC,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAY,MAAiB;QAC3B,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,EAAuB,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9C,2FAA2F;YAC3F,8BAA8B;YAC9B,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED;;;;qGAIiG;IACjG,aAAa,CAAC,IAAY,EAAE,IAAiD;QAC3E,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;;;uEAImE;IACnE,UAAU,CAAC,SAAqB,EAAE,WAAwB;QACxD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,KAAK,8FAA8F,CAAC,CAAC;YAC/I,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE;YACpB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK;oBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;qBACtC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;oBAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;;oBACjD,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;QACH,CAAC,EAAE,WAAW,CAAC,CAAC;IAClB,CAAC;IAED;;;iGAG6F;IAC7F,eAAe,CAAC,IAAY;QAC1B,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,aAAa,CAAC,GAAY,EAAE,GAAQ;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAe,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,QAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,eAAe,CAAC,GAAY;QAC1B,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,SAAqB;QAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK;gBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;iBACtC,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;gBAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;;gBACjD,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAc,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,CAAC,OAAgD;QACtD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;gDAE4C;IAC5C,gBAAgB,CAAC,OAAyC;QACxD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC;IACjC,CAAC;IAED;;;;;;;;;;oGAUgG;IACxF,QAAQ,CAAC,OAAiB;QAChC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,sDAAsD;QACjF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,UAAmB,CAAC;QACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,GAAG,CAAC,GAAY,EAAE,EAAE;YAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,UAAU,GAAG,GAAG,CAAC;YACnB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAG,CAAC;gBACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS,CAAC,yDAAyD;gBAC1F,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAC9B,IAAI,CAAC;oBACH,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;wBACrB,IAAI,CAAC;4BACH,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAe,EAAE,CAAC,CAAC;wBACxE,CAAC;wBAAC,OAAO,GAAG,EAAE,CAAC;4BACb,IAAI,CAAC,GAAG,CAAC,CAAC;wBACZ,CAAC;oBACH,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC;wBACH,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,gDAAgD;oBAC/E,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,CAAC,GAAG,CAAC,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,QAAQ;YAAE,MAAM,UAAU,CAAC;IACjC,CAAC;IAED,qFAAqF;IACrF,EAAE;IACF,qFAAqF;IACrF,qCAAqC;IAErC;;;;;;;;;;;;;4EAawE;IACxE,SAAS,CAAC,CAA6B,EAAE,WAAwB;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC,EAAE,CAAC,CAAC;QACN,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,aAAa,EAA8C,CAAC;QAC5F,WAAW,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;yEAKqE;IACrE,gBAAgB,CAAC,SAAiB,EAAE,MAAuB;QACzD,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED;;uFAEmF;IACnF,cAAc;QACZ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,EAAc,CAAC,CAAC;IACtD,CAAC;IAED,qFAAqF;IACrF,EAAE;IACF,8FAA8F;IAC9F,8FAA8F;IAC9F,0FAA0F;IAC1F,gGAAgG;IAChG,yFAAyF;IAEzF;;uFAEmF;IACnF,aAAa,CAAC,KAAa,EAAE,OAAe,EAAE,QAA4B;QACxE,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED,mGAAmG;IACnG,gBAAgB,CAAC,KAAa,EAAE,OAAe;QAC7C,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED;;;8CAG0C;IAC1C,QAAQ,CAAC,KAAa,EAAE,SAAiB,EAAE,GAAc;QACvD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;iDAM6C;IAC7C,cAAc,CAAC,KAAa,EAAE,SAAiB,EAAE,MAAiB;QAChE,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;;kFAO8E;IAC9E,YAAY,CAAC,KAAa,EAAE,SAAiB,EAAE,KAAgB;QAC7D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAa,CAAC,CAAC;IAC3E,CAAC;IAED;;;;+FAI2F;IAC3F,aAAa,CACX,KAAa,EACb,SAAiB,EACjB,KAAgB;QAEhB,OAAO,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,6FAA6F;IAC7F,YAAY,CAAC,KAAa,EAAE,SAAiB;QAC3C,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;2DAMuD;IACvD,YAAY,CAAC,KAAa,EAAE,GAAc;QACxC,OAAO,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;oDAOgD;IAChD,eAAe,CAAC,KAAa,EAAE,OAAe,EAAE,GAAc;QAC5D,OAAO,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAoB,MAAiB;IACxE,MAAM,QAAQ,EAAE,CAAC;IACjB,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rindle/wasm",
-  "version": "0.4.4",
+  "version": "0.5.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -29,7 +29,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@rindle/client": "0.4.4"
+    "@rindle/client": "0.5.0"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
@@ -39,7 +39,7 @@
     "build": "tsc -p tsconfig.build.json",
     "build:wasm": "./build.sh",
     "typecheck": "tsc --noEmit",
-    "test": "node test/bundle-size.mjs && node --conditions=@rindle/source test/e2e.mjs && node --conditions=@rindle/source test/one-start.e2e.mjs && node --conditions=@rindle/source test/repro-high.e2e.mjs && node --conditions=@rindle/source test/partial-write.e2e.mjs",
+    "test": "node test/bundle-size.mjs && node --conditions=@rindle/source test/e2e.mjs && node --conditions=@rindle/source test/one-start.e2e.mjs && node --conditions=@rindle/source test/repro-high.e2e.mjs && node --conditions=@rindle/source test/partial-write.e2e.mjs && node --conditions=@rindle/source test/room-source.e2e.mjs && node --conditions=@rindle/source test/predicate-agreement.e2e.mjs",
     "test:browser": "node test/browser-smoke.mjs"
   }
 }

package/pkg/rindle.d.ts

@@ -7,13 +7,69 @@
 export class Db {
     free(): void;
     [Symbol.dispose](): void;
+    /**
+     * Attach a room source to `table`, compiling `writable` into the merge's per-row
+     * [`WritableScope`] ([`parse_writable_scope`]): `{ kind: "all" }` = the room may write every row
+     * (room wins); `{ kind: "none" }` = a context table (daemon stays authoritative);
+     * `{ kind: "colEq", col, value }` = writable iff `row[col] == value` (harness stand-in);
+     * `{ kind: "predicate", where }` = the row-local wire-`Condition` predicate (Slice G-ii),
+     * lowered by the engine's own [`create_predicate`] against `table`'s schema.
+     */
+    addRoomSource(table: string, room_key: string, writable: any): void;
     /**
      * Tear down a registered query: drop its sink + reclaim its pipeline (disconnect from
      * the shared sources, free its slots — [`Graph::destroy_pipeline`]). Other queries
      * and the shared sources are untouched. A no-op for an unknown id.
      */
     destroyQuery(query_id: number): void;
+    /**
+     * Drop one parked hold-back at `probe`'s pk ([`Db::drop_held_back`] — the §301 fence-driven
+     * drop) and **deliver** the compensating deltas: returns the same
+     * `[{ queryId, events: FlatChange[] }]` shape as `WriteTxn.commit` (empty inside an open
+     * server-batch cycle, where the events join the cycle's one delivery instead) — unlike the
+     * park-time seams, whose install reconcile is a no-op by construction, a fence drop is
+     * exactly the moment a masked authoritative row becomes visible, so it must reach the
+     * views. `probe` is a full-width positional row (the pk derives from it — the same
+     * marshalling as [`holdBack`](Self::hold_back_js)).
+     */
+    dropHeldBack(table: string, source_key: string, probe: any): any;
+    /**
+     * Freeze a physical source — the D4 downgrade-ghost stub ([`Db::freeze_source`]).
+     */
+    freezeSource(table: string, source_key: string): void;
+    /**
+     * The parked hold-back at `probe`'s pk on `source_key`'s slice, as
+     * `{ absent: boolean, baseline: row | undefined } | undefined`
+     * ([`Db::held_back_state`], §301): `undefined` when nothing is parked — including an
+     * unknown source (non-throwing, so the client registry prunes lazily after a state-match
+     * drop or a room removal); `baseline` is the source's current confirmed-baseline row at
+     * the pk (the §2.5 stuck-pin tripwire input). An unknown TABLE still throws (the row
+     * cannot even be marshalled).
+     */
+    heldBackState(table: string, source_key: string, probe: any): any;
+    /**
+     * Park an echoed `row` inertly on `source_key`'s slice of `table` ([`Db::hold_back`]).
+     */
+    holdBack(table: string, source_key: string, row: any): void;
+    /**
+     * Park `old_row`'s pk as **absent** on `source_key`'s slice of `table`
+     * ([`Db::hold_back_absent`]) — the §7.3 tombstone for a confirmed cross-slice REMOVE.
+     * `old_row` is the full pre-image row, marshalled exactly like [`holdBack`](Self::hold_back_js)'s
+     * `row` (a full-width positional array of bare cells).
+     */
+    holdBackAbsent(table: string, source_key: string, old_row: any): void;
     constructor();
+    /**
+     * The winning source currently serving `row`'s pk on `table`, as its wasm-boundary key
+     * string (`"daemon"` / the room key, [`source_key_to_string`]), or `undefined` when no
+     * source holds the pk ([`Db::provenance`], §3.2 #3 — Slice H-i routing probe #1). `row` is
+     * a full-width positional row (the pk derives from it — the same marshalling as
+     * [`holdBack`](Self::hold_back_js)); an unknown table throws loudly. Reads the LIVE visible
+     * state, **overlay-first** (§7.3): an open [`WriteTxn`]'s staged-but-uncommitted writes are
+     * not consulted (they have not routed yet), which is exactly the pre-commit view the §3
+     * routing proof decides on.
+     */
+    provenanceOf(table: string, row: any): any;
     /**
      * Register a live query from a Zero-wire AST under the caller's opaque `query_id`.
      * Lowers it into the shared graph, sinks it in a change-sink, and hydrates. Returns
@@ -38,6 +94,10 @@ export class Db {
      * (`createSchema`, N1) has a loud backstop instead of a silent one.
      */
     registerTable(table: string, schema: any, local: boolean): void;
+    /**
+     * Detach a room source, emitting the compensating visible deltas ([`Db::remove_room_source`]).
+     */
+    removeRoomSource(table: string, room_key: string): void;
     /**
      * Open a §1.3 reconcile cycle against the coherent server delta `deltas` —
      * an array of base-table row ops `{ table, type: "add"|"remove"|"edit", row,
@@ -49,11 +109,15 @@ export class Db {
      * events buffer into the cycle), then calls
      * [`server_batch_end`](Db::server_batch_end) for the one coalesced delivery.
      *
+     * `source_key` names the authority these `deltas` confirm — `"daemon"` at the wasm boundary
+     * today (single-domain); a `room:doc:X` string once the room feed lands (Slice E-iii/G). It
+     * selects which physical source [`Merge::rewind`] folds the delta into.
+     *
      * Errors if a cycle is already open, on an unknown table, or on a push failure
-     * — after which the optimistic state is poisoned (a partial rewind may have
+     * — after which the per-source rebase state is poisoned (a partial rewind may have
      * applied): the only safe recovery is to discard this `Db` and re-hydrate.
      */
-    serverBatchBegin(deltas: any): void;
+    serverBatchBegin(source_key: string, deltas: any): void;
     /**
      * Close the open cycle: deliver the whole buffered event stream (rewind +
      * re-invocations) per query, **in order**, as `[{ queryId, events: FlatChange[] }]`
@@ -81,6 +145,17 @@ export class Db {
      * holds).
      */
     unregisterTable(table: string): void;
+    /**
+     * Evaluate the REGISTERED writable scope of `table`'s room source `room_key` against a
+     * caller-supplied full-width `row` ([`Db::writable_matches`] — Slice H-i routing probe #2):
+     * the §3 proof's write-set rule, run through the SAME compiled predicate the merge's winner
+     * tiering uses (the G-ii descriptor `addRoomSource` registered), so routing can never
+     * disagree with the engine. `{kind:"all"}` ⇒ always `true`; `{kind:"none"}` ⇒ always
+     * `false`; a frozen source still answers (the predicate is static). Loud errors: unknown
+     * table, a room key not attached to the table, a wrong-width row, and `"daemon"` (reserved
+     * by [`parse_source_key`]; the daemon has no writable scope).
+     */
+    writableMatches(table: string, room_key: string, row: any): boolean;
     /**
      * Open a write transaction. Stage row ops with [`WriteTxn::add`]/`remove`/`edit`,
      * then [`WriteTxn::commit`] to apply them as one batch and get the per-query flat
@@ -166,6 +241,16 @@ export class WriteTxn {
      * `serverBatchEnd`.
      */
     commit(): any;
+    /**
+     * Like [`commit`](WriteTxn::commit), but ALSO returns the per-change **touched-source key list**
+     * in staged order as `{ batches, sources: string[] }` (Slice E-iii-b, design Q1). Each `sources`
+     * entry is the [`SourceKey`] the corresponding staged change routed through — the pk's provenance
+     * captured **pre-apply** (a `remove` erases the row, so provenance is unrecoverable afterward),
+     * `"daemon"` for a new/unknown pk or any Collapsed table. The order aligns 1:1 with the staged
+     * writes, so the optimistic layer can zip it with a mutation's write-set (per-pk hold-back
+     * source, Slice E-iii-c). `batches` is exactly what [`commit`](WriteTxn::commit) returns.
+     */
+    commitTracked(): any;
     /**
      * Stage an edit of `old` → `new_row` in `table` (both width-checked).
      *
@@ -236,13 +321,22 @@ export interface InitOutput {
     readonly __wbg_db_free: (a: number, b: number) => void;
     readonly __wbg_rindleview_free: (a: number, b: number) => void;
     readonly __wbg_writetxn_free: (a: number, b: number) => void;
+    readonly db_addRoomSource: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number];
     readonly db_destroyQuery: (a: number, b: number) => void;
+    readonly db_dropHeldBack: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number, number];
+    readonly db_freezeSource: (a: number, b: number, c: number, d: number, e: number) => [number, number];
+    readonly db_heldBackState: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number, number];
+    readonly db_holdBack: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number];
+    readonly db_holdBackAbsent: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number];
     readonly db_new: () => number;
+    readonly db_provenanceOf: (a: number, b: number, c: number, d: any) => [number, number, number];
     readonly db_query: (a: number, b: number, c: any) => [number, number, number];
     readonly db_registerTable: (a: number, b: number, c: number, d: any, e: number) => [number, number];
-    readonly db_serverBatchBegin: (a: number, b: any) => [number, number];
+    readonly db_removeRoomSource: (a: number, b: number, c: number, d: number, e: number) => [number, number];
+    readonly db_serverBatchBegin: (a: number, b: number, c: number, d: any) => [number, number];
     readonly db_serverBatchEnd: (a: number) => [number, number, number];
     readonly db_unregisterTable: (a: number, b: number, c: number) => [number, number];
+    readonly db_writableMatches: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number, number];
     readonly db_write: (a: number) => number;
     readonly rindleview_build: (a: any, b: any, c: any) => [number, number, number];
     readonly rindleview_data: (a: number) => any;
@@ -253,6 +347,7 @@ export interface InitOutput {
     readonly rindleview_subscribe: (a: number, b: any) => number;
     readonly writetxn_add: (a: number, b: number, c: number, d: any) => [number, number];
     readonly writetxn_commit: (a: number) => [number, number, number];
+    readonly writetxn_commitTracked: (a: number) => [number, number, number];
     readonly writetxn_edit: (a: number, b: number, c: number, d: any, e: any) => [number, number];
     readonly writetxn_get: (a: number, b: number, c: number, d: any) => [number, number, number];
     readonly writetxn_query: (a: number, b: any) => [number, number, number];

package/pkg/rindle.js

@@ -14,6 +14,27 @@ export class Db {
         const ptr = this.__destroy_into_raw();
         wasm.__wbg_db_free(ptr, 0);
     }
+    /**
+     * Attach a room source to `table`, compiling `writable` into the merge's per-row
+     * [`WritableScope`] ([`parse_writable_scope`]): `{ kind: "all" }` = the room may write every row
+     * (room wins); `{ kind: "none" }` = a context table (daemon stays authoritative);
+     * `{ kind: "colEq", col, value }` = writable iff `row[col] == value` (harness stand-in);
+     * `{ kind: "predicate", where }` = the row-local wire-`Condition` predicate (Slice G-ii),
+     * lowered by the engine's own [`create_predicate`] against `table`'s schema.
+     * @param {string} table
+     * @param {string} room_key
+     * @param {any} writable
+     */
+    addRoomSource(table, room_key, writable) {
+        const ptr0 = passStringToWasm0(table, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(room_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.db_addRoomSource(this.__wbg_ptr, ptr0, len0, ptr1, len1, writable);
+        if (ret[1]) {
+            throw takeFromExternrefTable0(ret[0]);
+        }
+    }
     /**
      * Tear down a registered query: drop its sink + reclaim its pipeline (disconnect from
      * the shared sources, free its slots — [`Graph::destroy_pipeline`]). Other queries
@@ -23,12 +44,133 @@ export class Db {
     destroyQuery(query_id) {
         wasm.db_destroyQuery(this.__wbg_ptr, query_id);
     }
+    /**
+     * Drop one parked hold-back at `probe`'s pk ([`Db::drop_held_back`] — the §301 fence-driven
+     * drop) and **deliver** the compensating deltas: returns the same
+     * `[{ queryId, events: FlatChange[] }]` shape as `WriteTxn.commit` (empty inside an open
+     * server-batch cycle, where the events join the cycle's one delivery instead) — unlike the
+     * park-time seams, whose install reconcile is a no-op by construction, a fence drop is
+     * exactly the moment a masked authoritative row becomes visible, so it must reach the
+     * views. `probe` is a full-width positional row (the pk derives from it — the same
+     * marshalling as [`holdBack`](Self::hold_back_js)).
+     * @param {string} table
+     * @param {string} source_key
+     * @param {any} probe
+     * @returns {any}
+     */
+    dropHeldBack(table, source_key, probe) {
+        const ptr0 = passStringToWasm0(table, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(source_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.db_dropHeldBack(this.__wbg_ptr, ptr0, len0, ptr1, len1, probe);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return takeFromExternrefTable0(ret[0]);
+    }
+    /**
+     * Freeze a physical source — the D4 downgrade-ghost stub ([`Db::freeze_source`]).
+     * @param {string} table
+     * @param {string} source_key
+     */
+    freezeSource(table, source_key) {
+        const ptr0 = passStringToWasm0(table, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(source_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.db_freezeSource(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+        if (ret[1]) {
+            throw takeFromExternrefTable0(ret[0]);
+        }
+    }
+    /**
+     * The parked hold-back at `probe`'s pk on `source_key`'s slice, as
+     * `{ absent: boolean, baseline: row | undefined } | undefined`
+     * ([`Db::held_back_state`], §301): `undefined` when nothing is parked — including an
+     * unknown source (non-throwing, so the client registry prunes lazily after a state-match
+     * drop or a room removal); `baseline` is the source's current confirmed-baseline row at
+     * the pk (the §2.5 stuck-pin tripwire input). An unknown TABLE still throws (the row
+     * cannot even be marshalled).
+     * @param {string} table
+     * @param {string} source_key
+     * @param {any} probe
+     * @returns {any}
+     */
+    heldBackState(table, source_key, probe) {
+        const ptr0 = passStringToWasm0(table, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(source_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.db_heldBackState(this.__wbg_ptr, ptr0, len0, ptr1, len1, probe);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return takeFromExternrefTable0(ret[0]);
+    }
+    /**
+     * Park an echoed `row` inertly on `source_key`'s slice of `table` ([`Db::hold_back`]).
+     * @param {string} table
+     * @param {string} source_key
+     * @param {any} row
+     */
+    holdBack(table, source_key, row) {
+        const ptr0 = passStringToWasm0(table, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(source_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.db_holdBack(this.__wbg_ptr, ptr0, len0, ptr1, len1, row);
+        if (ret[1]) {
+            throw takeFromExternrefTable0(ret[0]);
+        }
+    }
+    /**
+     * Park `old_row`'s pk as **absent** on `source_key`'s slice of `table`
+     * ([`Db::hold_back_absent`]) — the §7.3 tombstone for a confirmed cross-slice REMOVE.
+     * `old_row` is the full pre-image row, marshalled exactly like [`holdBack`](Self::hold_back_js)'s
+     * `row` (a full-width positional array of bare cells).
+     * @param {string} table
+     * @param {string} source_key
+     * @param {any} old_row
+     */
+    holdBackAbsent(table, source_key, old_row) {
+        const ptr0 = passStringToWasm0(table, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(source_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.db_holdBackAbsent(this.__wbg_ptr, ptr0, len0, ptr1, len1, old_row);
+        if (ret[1]) {
+            throw takeFromExternrefTable0(ret[0]);
+        }
+    }
     constructor() {
         const ret = wasm.db_new();
         this.__wbg_ptr = ret;
         DbFinalization.register(this, this.__wbg_ptr, this);
         return this;
     }
+    /**
+     * The winning source currently serving `row`'s pk on `table`, as its wasm-boundary key
+     * string (`"daemon"` / the room key, [`source_key_to_string`]), or `undefined` when no
+     * source holds the pk ([`Db::provenance`], §3.2 #3 — Slice H-i routing probe #1). `row` is
+     * a full-width positional row (the pk derives from it — the same marshalling as
+     * [`holdBack`](Self::hold_back_js)); an unknown table throws loudly. Reads the LIVE visible
+     * state, **overlay-first** (§7.3): an open [`WriteTxn`]'s staged-but-uncommitted writes are
+     * not consulted (they have not routed yet), which is exactly the pre-commit view the §3
+     * routing proof decides on.
+     * @param {string} table
+     * @param {any} row
+     * @returns {any}
+     */
+    provenanceOf(table, row) {
+        const ptr0 = passStringToWasm0(table, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.db_provenanceOf(this.__wbg_ptr, ptr0, len0, row);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return takeFromExternrefTable0(ret[0]);
+    }
     /**
      * Register a live query from a Zero-wire AST under the caller's opaque `query_id`.
      * Lowers it into the shared graph, sinks it in a change-sink, and hydrates. Returns
@@ -72,6 +214,21 @@ export class Db {
             throw takeFromExternrefTable0(ret[0]);
         }
     }
+    /**
+     * Detach a room source, emitting the compensating visible deltas ([`Db::remove_room_source`]).
+     * @param {string} table
+     * @param {string} room_key
+     */
+    removeRoomSource(table, room_key) {
+        const ptr0 = passStringToWasm0(table, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(room_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.db_removeRoomSource(this.__wbg_ptr, ptr0, len0, ptr1, len1);
+        if (ret[1]) {
+            throw takeFromExternrefTable0(ret[0]);
+        }
+    }
     /**
      * Open a §1.3 reconcile cycle against the coherent server delta `deltas` —
      * an array of base-table row ops `{ table, type: "add"|"remove"|"edit", row,
@@ -83,13 +240,20 @@ export class Db {
      * events buffer into the cycle), then calls
      * [`server_batch_end`](Db::server_batch_end) for the one coalesced delivery.
      *
+     * `source_key` names the authority these `deltas` confirm — `"daemon"` at the wasm boundary
+     * today (single-domain); a `room:doc:X` string once the room feed lands (Slice E-iii/G). It
+     * selects which physical source [`Merge::rewind`] folds the delta into.
+     *
      * Errors if a cycle is already open, on an unknown table, or on a push failure
-     * — after which the optimistic state is poisoned (a partial rewind may have
+     * — after which the per-source rebase state is poisoned (a partial rewind may have
      * applied): the only safe recovery is to discard this `Db` and re-hydrate.
+     * @param {string} source_key
      * @param {any} deltas
      */
-    serverBatchBegin(deltas) {
-        const ret = wasm.db_serverBatchBegin(this.__wbg_ptr, deltas);
+    serverBatchBegin(source_key, deltas) {
+        const ptr0 = passStringToWasm0(source_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ret = wasm.db_serverBatchBegin(this.__wbg_ptr, ptr0, len0, deltas);
         if (ret[1]) {
             throw takeFromExternrefTable0(ret[0]);
         }
@@ -136,6 +300,31 @@ export class Db {
             throw takeFromExternrefTable0(ret[0]);
         }
     }
+    /**
+     * Evaluate the REGISTERED writable scope of `table`'s room source `room_key` against a
+     * caller-supplied full-width `row` ([`Db::writable_matches`] — Slice H-i routing probe #2):
+     * the §3 proof's write-set rule, run through the SAME compiled predicate the merge's winner
+     * tiering uses (the G-ii descriptor `addRoomSource` registered), so routing can never
+     * disagree with the engine. `{kind:"all"}` ⇒ always `true`; `{kind:"none"}` ⇒ always
+     * `false`; a frozen source still answers (the predicate is static). Loud errors: unknown
+     * table, a room key not attached to the table, a wrong-width row, and `"daemon"` (reserved
+     * by [`parse_source_key`]; the daemon has no writable scope).
+     * @param {string} table
+     * @param {string} room_key
+     * @param {any} row
+     * @returns {boolean}
+     */
+    writableMatches(table, room_key, row) {
+        const ptr0 = passStringToWasm0(table, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(room_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
+        const len1 = WASM_VECTOR_LEN;
+        const ret = wasm.db_writableMatches(this.__wbg_ptr, ptr0, len0, ptr1, len1, row);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return ret[0] !== 0;
+    }
     /**
      * Open a write transaction. Stage row ops with [`WriteTxn::add`]/`remove`/`edit`,
      * then [`WriteTxn::commit`] to apply them as one batch and get the per-query flat
@@ -309,6 +498,24 @@ export class WriteTxn {
         }
         return takeFromExternrefTable0(ret[0]);
     }
+    /**
+     * Like [`commit`](WriteTxn::commit), but ALSO returns the per-change **touched-source key list**
+     * in staged order as `{ batches, sources: string[] }` (Slice E-iii-b, design Q1). Each `sources`
+     * entry is the [`SourceKey`] the corresponding staged change routed through — the pk's provenance
+     * captured **pre-apply** (a `remove` erases the row, so provenance is unrecoverable afterward),
+     * `"daemon"` for a new/unknown pk or any Collapsed table. The order aligns 1:1 with the staged
+     * writes, so the optimistic layer can zip it with a mutation's write-set (per-pk hold-back
+     * source, Slice E-iii-c). `batches` is exactly what [`commit`](WriteTxn::commit) returns.
+     * @returns {any}
+     */
+    commitTracked() {
+        const ptr = this.__destroy_into_raw();
+        const ret = wasm.writetxn_commitTracked(ptr);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return takeFromExternrefTable0(ret[0]);
+    }
     /**
      * Stage an edit of `old` → `new_row` in `table` (both width-checked).
      *

package/pkg/rindle_bg.wasm.d.ts

@@ -5,13 +5,22 @@ export const __rindle_wasm_start: () => void;
 export const __wbg_db_free: (a: number, b: number) => void;
 export const __wbg_rindleview_free: (a: number, b: number) => void;
 export const __wbg_writetxn_free: (a: number, b: number) => void;
+export const db_addRoomSource: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number];
 export const db_destroyQuery: (a: number, b: number) => void;
+export const db_dropHeldBack: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number, number];
+export const db_freezeSource: (a: number, b: number, c: number, d: number, e: number) => [number, number];
+export const db_heldBackState: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number, number];
+export const db_holdBack: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number];
+export const db_holdBackAbsent: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number];
 export const db_new: () => number;
+export const db_provenanceOf: (a: number, b: number, c: number, d: any) => [number, number, number];
 export const db_query: (a: number, b: number, c: any) => [number, number, number];
 export const db_registerTable: (a: number, b: number, c: number, d: any, e: number) => [number, number];
-export const db_serverBatchBegin: (a: number, b: any) => [number, number];
+export const db_removeRoomSource: (a: number, b: number, c: number, d: number, e: number) => [number, number];
+export const db_serverBatchBegin: (a: number, b: number, c: number, d: any) => [number, number];
 export const db_serverBatchEnd: (a: number) => [number, number, number];
 export const db_unregisterTable: (a: number, b: number, c: number) => [number, number];
+export const db_writableMatches: (a: number, b: number, c: number, d: number, e: number, f: any) => [number, number, number];
 export const db_write: (a: number) => number;
 export const rindleview_build: (a: any, b: any, c: any) => [number, number, number];
 export const rindleview_data: (a: number) => any;
@@ -22,6 +31,7 @@ export const rindleview_setResultType: (a: number, b: number, c: number) => void
 export const rindleview_subscribe: (a: number, b: any) => number;
 export const writetxn_add: (a: number, b: number, c: number, d: any) => [number, number];
 export const writetxn_commit: (a: number) => [number, number, number];
+export const writetxn_commitTracked: (a: number) => [number, number, number];
 export const writetxn_edit: (a: number, b: number, c: number, d: any, e: any) => [number, number];
 export const writetxn_get: (a: number, b: number, c: number, d: any) => [number, number, number];
 export const writetxn_query: (a: number, b: any) => [number, number, number];

package/src/index.ts

@@ -13,6 +13,7 @@ import type {
   Backend,
   ChangeEvent,
   ColsMap,
+  Condition,
   Mutation,
   QueryId,
   Schema,
@@ -20,6 +21,23 @@ import type {
 
 export * from "@rindle/client";
 
+/** A serializable writable-scope descriptor: how the merge decides, per row, whether an attached
+ *  room may write it (the room copy then wins, RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §5.2).
+ *  `"all"` = the room owns every row it holds; `"none"` = a context table the daemon stays
+ *  authoritative for; `"colEq"` = writable iff `row[col] === value` (harness stand-in). The REAL
+ *  shape (Slice G) is `"predicate"`: `where` is the SAME wire {@link Condition} JSON a query AST
+ *  carries, restricted to what evaluates against a single row — `simple` column-vs-literal leaves
+ *  under `and`/`or`; a `correlatedSubquery` (or any other non-row-local node) is rejected loudly at
+ *  `addRoomSource` time. It compiles Rust-side through the engine's OWN filter lowering
+ *  (`create_predicate`), so writable evaluation can never disagree with query-filter semantics.
+ *  NOTE: room join-key columns (Slice H) deliberately do NOT cross this boundary — they stay
+ *  TS-side. */
+export type WritableDescriptor =
+  | { kind: "all" }
+  | { kind: "none" }
+  | { kind: "colEq"; col: number; value: unknown }
+  | { kind: "predicate"; where: Condition };
+
 // The wasm Db surface this backend uses (kept local so it doesn't depend on the generated .d.ts).
 interface WasmDb {
   registerTable(table: string, spec: { columns: string[]; primaryKey: number[] }, local: boolean): void;
@@ -27,8 +45,23 @@ interface WasmDb {
   query(queryId: number, ast: Ast): { comparatorVersion: number; schema: unknown; snapshot: unknown[] };
   destroyQuery(queryId: number): void;
   write(): WasmWriteTxn;
-  serverBatchBegin(deltas: ServerDeltaOp[]): void;
+  serverBatchBegin(sourceKey: string, deltas: ServerDeltaOp[]): void;
   serverBatchEnd(): Array<{ queryId: number; events: unknown[] }>;
+  // Multi-source seams (Slice E-iii-b harness → Slice G-ii ABI — see WritableDescriptor).
+  addRoomSource(table: string, roomKey: string, writable: WritableDescriptor): void;
+  removeRoomSource(table: string, roomKey: string): void;
+  holdBack(table: string, sourceKey: string, row: unknown[]): void;
+  holdBackAbsent(table: string, sourceKey: string, oldRow: unknown[]): void;
+  dropHeldBack(table: string, sourceKey: string, probe: unknown[]): unknown;
+  heldBackState(
+    table: string,
+    sourceKey: string,
+    probe: unknown[],
+  ): { absent: boolean; baseline: unknown[] | undefined } | undefined;
+  freezeSource(table: string, sourceKey: string): void;
+  // Slice H-i routing probes (design §3.1/§3.2 — see the WasmBackend mirrors below).
+  provenanceOf(table: string, row: unknown[]): string | undefined;
+  writableMatches(table: string, roomKey: string, row: unknown[]): boolean;
 }
 
 /** A raw staged write transaction over the wasm engine — the surface an optimistic client
@@ -46,6 +79,11 @@ export interface WasmWriteTxn {
    *  shape to a `view.data` row), in the query's order. */
   query(ast: Ast): unknown[];
   commit(): Array<{ queryId: number; events: unknown[] }>;
+  /** Like {@link commit}, additionally returning the per-change touched-source key list in staged
+   *  order (`sources`, e.g. `"daemon"` / `"room:doc:1"`) — the provenance each staged write routed
+   *  through, captured pre-apply (Slice E-iii-b, design Q1). `batches` is exactly {@link commit}'s
+   *  return; the source list is additive. */
+  commitTracked(): { batches: Array<{ queryId: number; events: unknown[] }>; sources: string[] };
   rollback(): void;
 }
 
@@ -242,22 +280,29 @@ export class WasmBackend<S extends ColsMap> implements Backend {
    *  `onCommitted` runs after `tx.commit()` returns but before `dispatch` delivers to
    *  subscribers: a throw from `f` (pre-commit — engine untouched) skips it; a subscriber
    *  throw re-raised by `dispatch` happens after it. It is the only point where "the commit
-   *  is applied" is knowable to a caller that must not confuse the two failure modes. */
-  writeWith(f: (tx: WasmWriteTxn) => void, onCommitted?: () => void): void {
+   *  is applied" is knowable to a caller that must not confuse the two failure modes.
+   *
+   *  Returns the per-change **touched-source key list** in staged-write order (`"daemon"` /
+   *  `"room:doc:X"`, Slice E-iii-b design Q1) — additive; every current caller (`mutate`,
+   *  `writeLocal`, `@rindle/optimistic`) ignores it. The per-source reconcile (Slice E-iii-c) zips
+   *  it with the mutation's write-set for the per-pk hold-back source. */
+  writeWith(f: (tx: WasmWriteTxn) => void, onCommitted?: () => void): string[] {
     const tx = this.db.write();
     f(tx);
-    const batches = tx.commit() as BatchSet;
+    const { batches, sources } = tx.commitTracked() as { batches: BatchSet; sources: string[] };
     onCommitted?.();
     this.dispatch(batches);
+    return sources;
   }
 
-  /** Open a §1.3 reconcile cycle against the coherent server delta: the engine rewinds
-   *  (optimistic layer un-applied, delta folded in, `sync` re-forked) and starts
-   *  buffering. Re-invoke the still-pending mutators via {@link writeWith}, then call
-   *  {@link serverBatchEnd}. On error the optimistic state is poisoned — discard the
-   *  backend and re-hydrate. */
-  serverBatchBegin(deltas: ServerDeltaOp[]): void {
-    this.db.serverBatchBegin(deltas);
+  /** Open a §1.3 reconcile cycle against the coherent server delta: the engine rewinds the
+   *  per-source rebase (optimistic layer un-applied, delta folded in, the source's baseline
+   *  re-forked) and starts buffering. `sourceKey` names the authority the delta confirms —
+   *  `"daemon"` today (single-domain); a `room:doc:X` key once the room feed lands. Re-invoke the
+   *  still-pending mutators via {@link writeWith}, then call {@link serverBatchEnd}. On error the
+   *  rebase state is poisoned — discard the backend and re-hydrate. */
+  serverBatchBegin(sourceKey: string, deltas: ServerDeltaOp[]): void {
+    this.db.serverBatchBegin(sourceKey, deltas);
   }
 
   /** Close the cycle: the whole buffered stream (rewind + re-invocations) coalesces to
@@ -266,6 +311,98 @@ export class WasmBackend<S extends ColsMap> implements Backend {
   serverBatchEnd(): void {
     this.dispatch(this.db.serverBatchEnd() as BatchSet);
   }
+
+  // --- multi-source seams (Slice E-iii-b harness → Slice G-ii ABI) ------------------
+  //
+  // Thin pass-throughs to the engine's `Merge` (RINDLE-REALTIME-QUERY-ENABLEMENT-DESIGN.md §5).
+  // `addRoomSource`'s {@link WritableDescriptor} now carries the real row-local `predicate` arm
+  // (a wire-Condition `where`, compiled Rust-side through the engine's own filter lowering)
+  // alongside the narrow `all`/`none`/`colEq` harness shapes. Single-domain behavior is untouched
+  // unless `addRoomSource` is called (a table stays Collapsed = today's daemon-only path).
+
+  /** Attach a room source to `table`, compiling `writable` into the merge's per-row writable scope.
+   *  Promotes the table Collapsed → Merged on the first room (§5.2); the room seeds empty, so no
+   *  visible blip. Throws on an untracked (local-only) table or a duplicate room. */
+  addRoomSource(table: string, roomKey: string, writable: WritableDescriptor): void {
+    this.db.addRoomSource(table, roomKey, writable);
+  }
+
+  /** Detach a room source, emitting the compensating visible deltas on the ordinary event stream. */
+  removeRoomSource(table: string, roomKey: string): void {
+    this.db.removeRoomSource(table, roomKey);
+  }
+
+  /** Park an echoed `row` inertly on `sourceKey`'s slice of `table` (the confirm→echo hold-back
+   *  window, design §7.3): keeps the row visible so the next per-source rewind of `sourceKey` does
+   *  not flash-revert a confirmed-elsewhere write before its data echo lands. `sourceKey` is
+   *  `"daemon"` or a `"room:doc:X"` key. */
+  holdBack(table: string, sourceKey: string, row: unknown[]): void {
+    this.db.holdBack(table, sourceKey, row);
+  }
+
+  /** Park `oldRow`'s pk as ABSENT on `sourceKey`'s slice of `table` — the §7.3 tombstone, the
+   *  remove-sibling of {@link holdBack} (Slice G-ii): a confirmed cross-slice REMOVE whose delete
+   *  echo has not landed on `sourceKey` must not resurrect through that source's next rewind. The
+   *  overlay masks the pk (overlay-first) until the source's re-forked baseline lacks it (the
+   *  delete echoed), then drops. `oldRow` is the full-width PRE-IMAGE row (same positional
+   *  bare-cell marshaling as {@link holdBack}); it carries the pk and, later (Slice H), the cells
+   *  writable-scope predicates evaluate on. */
+  holdBackAbsent(table: string, sourceKey: string, oldRow: unknown[]): void {
+    this.db.holdBackAbsent(table, sourceKey, oldRow);
+  }
+
+  /** Drop one parked §7.3 hold-back at `probe`'s pk on `sourceKey`'s slice and reconcile the
+   *  pk's visible winner — the §301 FENCE-driven drop (`301-ECHO-FENCE-DESIGN.md` §2.2), fired
+   *  by the optimistic backend's pin registry once `sourceKey`'s stream has provably delivered
+   *  through the pinned write's commit. Unlike the park-time seams (whose install is a no-op by
+   *  construction) a drop is exactly the moment a masked authoritative row becomes visible, so
+   *  the engine's compensating deltas are DELIVERED here: dispatched on the ordinary event
+   *  stream (or folded into an open server-batch cycle's one delivery). No-op when nothing is
+   *  parked at the pk — the rewind's state-match fallback may have raced it. */
+  dropHeldBack(table: string, sourceKey: string, probe: unknown[]): void {
+    this.dispatch(this.db.dropHeldBack(table, sourceKey, probe) as BatchSet);
+  }
+
+  /** The parked hold-back at `probe`'s pk on `sourceKey`'s slice, or `undefined` (§301
+   *  introspection): `absent` names the tombstone variant; `baseline` is the source's CURRENT
+   *  confirmed-baseline row at the pk (`undefined` when the baseline lacks it) — the pin
+   *  registry's lazy-prune probe and the §2.5 stuck-pin tripwire input. Non-throwing on an
+   *  unknown source (a removed room), so pruning after a whole-source removal just works. */
+  heldBackState(
+    table: string,
+    sourceKey: string,
+    probe: unknown[],
+  ): { absent: boolean; baseline: unknown[] | undefined } | undefined {
+    return this.db.heldBackState(table, sourceKey, probe);
+  }
+
+  /** Freeze a physical source — the D4 downgrade-ghost stub (wins-if-present in the merge). */
+  freezeSource(table: string, sourceKey: string): void {
+    this.db.freezeSource(table, sourceKey);
+  }
+
+  /** The source currently serving `row`'s pk on `table` — `"daemon"`, a room key, or `undefined`
+   *  when no source holds the pk (Slice H-i routing probe #1, design §3.2 #3). `row` is a
+   *  full-width positional row (the pk derives from it — same marshaling as {@link holdBack});
+   *  an unknown table throws loudly. Reads the LIVE visible state, overlay-first (§7.3): an open
+   *  write txn's staged-but-uncommitted rows are NOT consulted (they have not routed yet), which
+   *  is exactly the pre-commit view the §3 routing proof decides on — a present read is proven
+   *  room-covered iff this reports the occupied room. */
+  provenanceOf(table: string, row: unknown[]): string | undefined {
+    return this.db.provenanceOf(table, row);
+  }
+
+  /** Evaluate the REGISTERED writable scope of `table`'s room source `roomKey` against a
+   *  caller-supplied full-width row (Slice H-i routing probe #2, design §3.1): a prediction-run
+   *  write is proven room-covered iff this is `true` on the written row. Runs the SAME compiled
+   *  predicate the merge's winner tiering uses (the {@link WritableDescriptor} registered at
+   *  {@link addRoomSource}), so routing can never disagree with the engine; `all` ⇒ always true,
+   *  `none` ⇒ always false, and a frozen source still answers (the predicate is static). Throws
+   *  loudly on an unknown table, a room key not attached to the table, a wrong-width row, or
+   *  `"daemon"` (which has no writable scope). */
+  writableMatches(table: string, roomKey: string, row: unknown[]): boolean {
+    return this.db.writableMatches(table, roomKey, row);
+  }
 }
 
 /** Convenience: init the wasm + return a ready local {@link Store}. */