@voltro/plugin-rooms 0.0.0-stage → 0.88.0

package/dist/lockstepServer.d.ts

@@ -0,0 +1,3897 @@
+import { Context } from 'effect';
+import { DataStore } from '@voltro/database';
+import { DeclaredAccess } from '@voltro/protocol';
+import { Duration } from 'effect';
+import { Effect } from 'effect';
+import { Layer } from 'effect';
+import { PluginPrivacyRequest } from '@voltro/protocol';
+import { Result } from 'effect';
+import { Schema } from 'effect';
+import { SessionSecrets } from '@voltro/protocol/session';
+import { YieldableError } from 'effect/Cause';
+
+/** Configuration consumers never invoke a player callback. Its player type
+ * stays author-owned; this inventory type does not erase it into an input. */
+declare type AnyWorldDescriptor = WorldDescriptor<never>;
+
+declare type CollisionBody2D = {
+    readonly kind: 'circle';
+    readonly radius: number;
+} | {
+    readonly kind: 'aabb';
+    readonly halfWidth: number;
+    readonly halfHeight: number;
+};
+
+declare interface CollisionResult2D {
+    readonly transform: Transform2D;
+    readonly collided: ReadonlyArray<string>;
+    readonly iterations: number;
+}
+
+export declare const createRoomLockstepHostLoop: <S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(simulation: Simulation<S, I, O>, seed: number, options: O["Type"], scope: RoomLockstepRosterScope, now: () => number, serverOptions?: RoomLockstepServerOptions, loopOptions?: RoomLockstepHostLoopOptions) => RoomLockstepHostLoop<S, I, O>;
+
+export declare const createRoomLockstepInputRoster: <I extends Schema.Codec<unknown, unknown>>(schema: I, scope: RoomLockstepRosterScope, options?: RoomLockstepRosterOptions) => RoomLockstepInputRoster<I>;
+
+export declare const createRoomLockstepServer: <S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(simulation: Simulation<S, I, O>, seed: number, options: O["Type"], scope: RoomLockstepRosterScope, budgets?: RoomLockstepServerOptions) => RoomLockstepServer<S, I, O>;
+
+export declare const createRoomLockstepTransportOwner: <S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(simulation: Simulation<S, I, O>, seed: number, options: O["Type"], scope: RoomLockstepRosterScope, now: () => number, serverOptions?: RoomLockstepServerOptions, loopOptions?: RoomLockstepHostLoopOptions, transportOptions?: RoomLockstepTransportOptions) => RoomLockstepTransportOwner<S, I, O>;
+
+/** Real SQL pre-seat creation: immutable seed/options/schema/creator, no fake
+ * state checkpoint or game actor. Shared Room row remains the sole truth. */
+export declare const dataStoreRoomLockstepAdmission: <S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(store: DataStore, offeredDescriptor: RoomLockstepDescriptor<S, I, O>, offered: RoomLockstepAdmissionStoreOptions) => Context.Service.Shape<typeof RoomLockstepAdmissionPort>;
+
+/** The journal's header is an owned nullable JSON column on the Room row, its confirmed
+ * inputs one row per tick (`lockstepJournalRows.ts`): SQL alone retains seed, options,
+ * admitted roster and every confirmed input; no simulation in this store. An append writes
+ * one row and the small header, whatever the match length. Bound full history refuses
+ * exhaustion rather than pruning a Relay's rebuild base. */
+export declare const dataStoreRoomLockstepJournal: <S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(store: DataStore, simulation: Simulation<S, I, O>, offered: RoomLockstepJournalStoreOptions) => Context.Service.Shape<typeof RoomLockstepJournalPort>;
+
+/** Same existing SQL Room row, exact current owner and admission receipt. */
+export declare const dataStoreRoomLockstepTerminal: <S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(store: DataStore, offeredDescriptor: RoomLockstepDescriptor<S, I, O>, offered: RoomLockstepTerminalStoreOptions) => Context.Service.Shape<typeof RoomLockstepTerminalPort>;
+
+/** Exact reduced integer ratio over admitted coordinates/differences of magnitude <= u32.
+ * Shared 2D/3D slab arithmetic; never round a fraction before comparing it. */
+declare interface FixedSlabFraction {
+    readonly numerator: number;
+    readonly denominator: number;
+}
+
+declare interface GeometryActivation {
+    readonly _tag: 'GeometryActivation';
+    readonly receipt: GeometryPersistenceReceipt;
+}
+
+declare interface GeometryActorInventory {
+    at(coordinate: GeometryPreparedCoordinate): GeometryPreparedEntry;
+    contains(coordinate: GeometryPreparedCoordinate): boolean;
+    /** CPU pointer activation only; a stale before-frame refuses, exact repeat is false. */
+    activate(activation: GeometryActivation): boolean;
+    /** CPU-only whole-version swap after genuine outside-Tick SQL preparation. */
+    activateVersion(activation: GeometryVersionActivation): boolean;
+    observation(): GeometryActorInventoryObservation;
+    close(): void;
+}
+
+declare interface GeometryActorInventoryObservation {
+    readonly scope: GeometryPreparedScope;
+    readonly generation: number;
+    readonly chunks: number;
+    readonly accountedBytes: number;
+    readonly closed: boolean;
+}
+
+declare interface GeometryArtifact<C extends GeometryChunk = GeometryChunk> {
+    readonly chunk: C;
+    readonly blobSha256: string;
+    /** Canonical declared content/layout, excluding actual address/version only. */
+    readonly contentSha256: string;
+    bytes(): Uint8Array;
+}
+
+declare type GeometryArtifactLimits<K extends GeometryKind> = K extends '2d-tiles' ? Partial<GeometryTileLimits> : K extends '2d-heightfield' ? Partial<GeometryHeightfieldLimits> : K extends '3d-shapes' ? Partial<GeometryShapesLimits> : Partial<GeometryVoxelLimits>;
+
+declare interface GeometryBoxOverlapOptions {
+    readonly maxTests?: number;
+}
+
+declare type GeometryChunk = GeometryTileChunk | GeometryHeightfieldChunk | GeometryShapesChunk | GeometryVoxelChunk;
+
+declare type GeometryCollisionDerive = (context: GeometryDerivationContext) => GeometryChunk;
+
+declare type GeometryCompaction = (context: GeometryCompactionContext) => GeometryPatch;
+
+/** Genuine immutable native artifacts only. Compaction preserves the current
+ * truth; it cannot authorize a different edit, owner, revision or SQL write. */
+declare interface GeometryCompactionContext {
+    readonly static: GeometryArtifact;
+    readonly current: GeometryArtifact;
+    readonly limits: GeometryPatchLimits;
+    readonly codecLimits: GeometryArtifactLimits<GeometryKind>;
+}
+
+declare interface GeometryCompactionStrategies {
+    readonly compaction: GeometryCompaction;
+}
+
+declare interface GeometryDeltaMigrationFrom {
+    readonly static: GeometryArtifact;
+    readonly current: GeometryArtifact;
+    readonly revision: number;
+}
+
+declare interface GeometryDeltaMigrationTo {
+    readonly static: GeometryArtifact;
+}
+
+/** Outside-Tick native data only. No query callback, provider, actor, Store or
+ * authority capability is accepted as a derivation result. */
+declare interface GeometryDerivationContext {
+    readonly chunk: GeometryChunk;
+    readonly codecLimits: GeometryArtifactLimits<GeometryKind>;
+}
+
+declare interface GeometryDerivationStrategies {
+    readonly collisionDerive: GeometryCollisionDerive;
+    readonly navDerive: GeometryNavDerive;
+}
+
+/** Trusted server snapshot. Never derive these rights, positions, budgets or
+ * catalogs from the intent body. App policy must recheck authority at commit. */
+declare interface GeometryEditAuthority {
+    readonly dynamicEnabled: boolean;
+    readonly ownsChunk: boolean;
+    readonly canBuild: boolean;
+    readonly cooldownReady: boolean;
+    readonly remainingOps: number;
+    readonly maxReachRaw: number;
+    readonly maxHeightUnits: number;
+    readonly position: {
+        readonly xRaw: number;
+        readonly yRaw: number;
+        readonly zRaw: number;
+    };
+    readonly materials: ReadonlyArray<GeometryTileMaterial>;
+    readonly shapes: ReadonlyArray<GeometryShapeTemplate>;
+}
+
+declare interface GeometryEditContext {
+    readonly chunk: GeometryChunk;
+    readonly intent: GeometryEditIntent;
+    readonly authority: GeometryEditAuthority;
+    readonly placementId: string;
+    readonly codecLimits?: GeometryArtifactLimits<GeometryKind> | undefined;
+}
+
+/** Player requests an action and its target, never solidity, shape dimensions,
+ * an authoritative player position, revision, owner, full chunk or Delta bytes. */
+declare type GeometryEditIntent = {
+    readonly op: 'setTile';
+    readonly x: number;
+    readonly y: number;
+    readonly material: string;
+} | {
+    readonly op: 'raiseHeight';
+    readonly x: number;
+    readonly y: number;
+    readonly units: number;
+} | {
+    readonly op: 'setVoxel';
+    readonly x: number;
+    readonly y: number;
+    readonly z: number;
+    readonly material: string;
+} | {
+    readonly op: 'placeShape';
+    readonly template: string;
+    readonly xRaw: number;
+    readonly yRaw: number;
+    readonly zRaw: number;
+} | {
+    readonly op: 'removeShape';
+    readonly id: string;
+};
+
+declare interface GeometryEditStrategies {
+    /** Pure policy slot. Current native Session/SQL ownership and codec integrity cannot be overridden by this slot. */
+    readonly opValidator: (context: GeometryEditContext) => void;
+    /** Pure rule slot; returned chunk is admitted under the original identity/layout/profile. */
+    readonly applyOp: (context: GeometryEditContext) => GeometryChunk;
+}
+
+declare type GeometryGenerator = (context: GeometryProceduralContext) => GeometryChunk;
+
+declare interface GeometryGridRayHit {
+    readonly kind: '2d-tiles' | '3d-voxel';
+    readonly scope: GeometryPersistenceScope;
+    readonly revision: number;
+    readonly cell: {
+        readonly x: number;
+        readonly y: number;
+        readonly z?: number;
+    };
+    /** Exact reduced infimum entry fraction on the offered segment, not a
+     * rounded contact point or a floating-point distance. */
+    readonly fraction: {
+        readonly numerator: number;
+        readonly denominator: number;
+    };
+    readonly visitedCells: number;
+}
+
+declare interface GeometryGridRayOptions {
+    readonly maxVisitedCells?: number;
+}
+
+declare interface GeometryGridSweepHit {
+    readonly kind: '2d-tiles' | '3d-voxel';
+    readonly scope: GeometryPersistenceScope;
+    readonly revision: number;
+    readonly cell: {
+        readonly x: number;
+        readonly y: number;
+        readonly z?: number;
+    };
+    /** Infimum/supremum of positive-volume overlap, clipped to [0,1]. Contact
+     * alone is not an overlap; fractions are exact reduced integer ratios. */
+    readonly entry: FixedSlabFraction;
+    readonly exit: FixedSlabFraction;
+    readonly initialOverlap: boolean;
+    readonly testedCells: number;
+}
+
+/** A half-open raw box `[min, max)` on all three axes; a heightfield box needs its z extent. */
+declare interface GeometryHeightfieldBoxRaw {
+    readonly minXRaw: number;
+    readonly minYRaw: number;
+    readonly minZRaw: number;
+    readonly maxXRaw: number;
+    readonly maxYRaw: number;
+    readonly maxZRaw: number;
+}
+
+declare type GeometryHeightfieldChunk = (typeof GeometryHeightfieldChunkSchema)["Type"];
+
+declare const GeometryHeightfieldChunkSchema: Schema.Struct<{
+    readonly kind: Schema.Literal<"2d-heightfield">;
+    readonly formatVersion: Schema.Literal<1>;
+    readonly address: Schema.Struct<{
+        readonly worldId: Schema.String;
+        readonly layerSetId: Schema.String;
+        readonly cx: Schema.Int;
+        readonly cy: Schema.Int;
+    }>;
+    readonly version: Schema.String;
+    readonly width: Schema.Int;
+    readonly height: Schema.Int;
+    readonly sampleSpacingRaw: Schema.Int;
+    readonly baseHeightRaw: Schema.Int;
+    readonly heightQuantumRaw: Schema.Int;
+    readonly heights: Schema.$Array<Schema.Int>;
+}>;
+
+declare interface GeometryHeightfieldLimits {
+    readonly maxSide: number;
+    readonly maxSamples: number;
+    readonly maxBytes: number;
+}
+
+declare interface GeometryHeightfieldRayHit {
+    readonly kind: '2d-heightfield';
+    readonly scope: GeometryPersistenceScope;
+    readonly revision: number;
+    /** The first point on the segment at or below the surface, in global raw units. */
+    readonly point: GeometryHeightfieldRayPoint;
+    /** Exact reduced position on the offered segment whose raw-grid point is `point`. */
+    readonly fraction: {
+        readonly numerator: number;
+        readonly denominator: number;
+    };
+    readonly visitedSamples: number;
+}
+
+declare interface GeometryHeightfieldRayPoint {
+    readonly xRaw: number;
+    readonly yRaw: number;
+    readonly zRaw: number;
+}
+
+declare interface GeometryHeightfieldSweepHit {
+    readonly kind: '2d-heightfield';
+    /** The first box position along the path that reaches under the surface, on the raw grid. */
+    readonly box: GeometryHeightfieldBoxRaw;
+    /** Exact reduced position of `box` on the path: raw steps along the longest axis over its length. */
+    readonly fraction: {
+        readonly numerator: number;
+        readonly denominator: number;
+    };
+    /** The start box already reaches under the surface (fraction 0). */
+    readonly initialOverlap: boolean;
+    /** Overlap evaluations used, coarse and refining together. */
+    readonly evaluations: number;
+}
+
+declare interface GeometryHeightfieldView {
+    readonly chunk: GeometryHeightfieldChunk;
+    heightAtSample(x: number, y: number): number;
+    heightAtRaw(xRaw: number, yRaw: number): number;
+}
+
+declare type GeometryKind = GeometryChunk['kind'];
+
+/** Pure native data rule only; no SQL, actor, journal, permission or Subject. */
+declare type GeometryMigrateDelta = (from: GeometryDeltaMigrationFrom, to: GeometryDeltaMigrationTo) => GeometryChunk | null;
+
+declare interface GeometryMigrationReceipt {
+    readonly requestKey: string;
+    readonly inputSha256: string;
+    readonly from: GeometryPersistenceScope;
+    readonly to: GeometryPersistenceScope;
+    readonly fromRevision: number;
+    readonly revision: number;
+    readonly decision: 'kept' | 'discarded' | 'custom';
+    readonly staticChanged: boolean;
+    readonly fromManifestSha256: string;
+    readonly toManifestSha256: string;
+    readonly blobSha256: string;
+    readonly contentSha256: string;
+}
+
+declare type GeometryNavDerive = (context: GeometryDerivationContext) => GeometryTileChunk | null;
+
+declare interface GeometryPatch {
+    readonly metadata: GeometryPatchMetadata;
+    bytes(): Uint8Array;
+}
+
+declare interface GeometryPatchLimits {
+    readonly maxBytes: number;
+    readonly maxMetadataBytes: number;
+}
+
+declare type GeometryPatchMetadata = (typeof GeometryPatchMetadataSchema)["Type"];
+
+declare const GeometryPatchMetadataSchema: Schema.Struct<{
+    readonly kind: Schema.Literals<readonly ["2d-tiles", "2d-heightfield", "3d-shapes", "3d-voxel"]>;
+    readonly formatVersion: Schema.Literal<1>;
+    readonly worldId: Schema.String;
+    readonly layerSetId: Schema.String;
+    readonly cx: Schema.Int;
+    readonly cy: Schema.Int;
+    readonly cz: Schema.optional<Schema.Int>;
+    readonly version: Schema.String;
+    readonly baseRevision: Schema.Int;
+    readonly revision: Schema.Int;
+    readonly baseBlobSha256: Schema.String;
+    readonly blobSha256: Schema.String;
+    readonly baseContentSha256: Schema.String;
+    readonly contentSha256: Schema.String;
+    readonly changed: Schema.Boolean;
+    readonly stateSchemaHash: Schema.Int;
+}>;
+
+declare interface GeometryPersistenceReceipt {
+    readonly scope: GeometryPersistenceScope;
+    readonly requestId: string;
+    readonly baseRevision: number;
+    readonly revision: number;
+    readonly changed: boolean;
+    readonly blobSha256: string;
+    readonly contentSha256: string;
+}
+
+declare interface GeometryPersistenceScope {
+    readonly tenantId: string;
+    readonly kind: GeometryKind;
+    readonly worldId: string;
+    readonly version: string;
+    readonly layerSetId: string;
+    readonly cx: number;
+    readonly cy: number;
+    readonly cz?: number | undefined;
+}
+
+declare interface GeometryPersistenceSubject {
+    readonly id: string;
+    readonly kind: 'user' | 'guest';
+}
+
+declare interface GeometryPointRaw3D {
+    readonly xRaw: number;
+    readonly yRaw: number;
+    readonly zRaw: number;
+}
+
+declare interface GeometryPreparedCoordinate {
+    readonly cx: number;
+    readonly cy: number;
+    readonly cz?: number | undefined;
+}
+
+declare type GeometryPreparedEntry = PreparedCommon & GeometryPreparedView & {
+    /** Independently prepared native collision data. Original view/artifact remains the edit/rebuild baseline. */
+    readonly collision: GeometryPreparedView;
+    readonly navigation: GeometryTileView | null;
+};
+
+declare interface GeometryPreparedScope {
+    readonly tenantId: string;
+    readonly kind: GeometryKind;
+    readonly worldId: string;
+    readonly layerSetId: string;
+    readonly version: string;
+}
+
+declare type GeometryPreparedView = ({
+    readonly kind: '2d-tiles';
+    readonly view: GeometryTileView;
+} | {
+    readonly kind: '2d-heightfield';
+    readonly view: GeometryHeightfieldView;
+} | {
+    readonly kind: '3d-shapes';
+    readonly view: GeometryShapesView;
+} | {
+    readonly kind: '3d-voxel';
+    readonly view: GeometryVoxelView;
+});
+
+declare interface GeometryPrivacyTarget {
+    readonly tenantId: string;
+    readonly subject: GeometryPersistenceSubject;
+    readonly requestId: string;
+}
+
+declare interface GeometryProceduralContext {
+    readonly seed: number;
+    readonly kind: GeometryKind;
+    readonly address: GeometryChunk['address'];
+    readonly version: string;
+}
+
+declare type GeometryShape = (typeof GeometryShapeSchema)["Type"];
+
+declare interface GeometryShapeRayHit {
+    readonly kind: '3d-shapes';
+    readonly scope: GeometryPersistenceScope;
+    readonly revision: number;
+    /** Native LOCAL shape; scope identifies its owning chunk. */
+    readonly shape: GeometryShape;
+    /** Encloses the exact infimum entry time; width <= 2^-52. Presentation only.
+     * Selection and ownership decisions never use these rounded bounds. */
+    readonly fractionBounds: {
+        readonly lower: number;
+        readonly upper: number;
+    };
+    readonly visitedChunks: number;
+    readonly testedShapes: number;
+}
+
+declare const GeometryShapeSchema: Schema.Union<readonly [Schema.Struct<{
+    readonly halfXRaw: Schema.Int;
+    readonly halfYRaw: Schema.Int;
+    readonly halfZRaw: Schema.Int;
+    readonly id: Schema.String;
+    readonly xRaw: Schema.Int;
+    readonly yRaw: Schema.Int;
+    readonly zRaw: Schema.Int;
+    readonly kind: Schema.Literal<"aabb">;
+}>, Schema.Struct<{
+    readonly radiusRaw: Schema.Int;
+    readonly id: Schema.String;
+    readonly xRaw: Schema.Int;
+    readonly yRaw: Schema.Int;
+    readonly zRaw: Schema.Int;
+    readonly kind: Schema.Literal<"sphere">;
+}>]>;
+
+declare type GeometryShapesChunk = (typeof GeometryShapesChunkSchema)["Type"];
+
+declare const GeometryShapesChunkSchema: Schema.Struct<{
+    readonly kind: Schema.Literal<"3d-shapes">;
+    readonly formatVersion: Schema.Literal<1>;
+    readonly address: Schema.Struct<{
+        readonly worldId: Schema.String;
+        readonly layerSetId: Schema.String;
+        readonly cx: Schema.Int;
+        readonly cy: Schema.Int;
+        readonly cz: Schema.Int;
+    }>;
+    readonly version: Schema.String;
+    readonly extentXRaw: Schema.Int;
+    readonly extentYRaw: Schema.Int;
+    readonly extentZRaw: Schema.Int;
+    readonly shapes: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+        readonly halfXRaw: Schema.Int;
+        readonly halfYRaw: Schema.Int;
+        readonly halfZRaw: Schema.Int;
+        readonly id: Schema.String;
+        readonly xRaw: Schema.Int;
+        readonly yRaw: Schema.Int;
+        readonly zRaw: Schema.Int;
+        readonly kind: Schema.Literal<"aabb">;
+    }>, Schema.Struct<{
+        readonly radiusRaw: Schema.Int;
+        readonly id: Schema.String;
+        readonly xRaw: Schema.Int;
+        readonly yRaw: Schema.Int;
+        readonly zRaw: Schema.Int;
+        readonly kind: Schema.Literal<"sphere">;
+    }>]>>;
+}>;
+
+declare interface GeometryShapesLimits {
+    readonly maxShapes: number;
+    readonly maxBytes: number;
+}
+
+declare interface GeometryShapesView {
+    readonly chunk: GeometryShapesChunk;
+    containingRaw(point: GeometryPointRaw3D, maximumShapes?: number): ReadonlyArray<GeometryShape>;
+    /** Closed LOCAL segment and native volumes. Canonical ID order, not distance
+     * order; no first-hit fraction or cross-chunk ownership is implied. */
+    intersectingSegmentRaw(from: GeometryPointRaw3D, to: GeometryPointRaw3D, maximumShapes?: number): ReadonlyArray<GeometryShape>;
+}
+
+declare type GeometryShapeTemplate = {
+    readonly key: string;
+    readonly kind: 'aabb';
+    readonly halfXRaw: number;
+    readonly halfYRaw: number;
+    readonly halfZRaw: number;
+} | {
+    readonly key: string;
+    readonly kind: 'sphere';
+    readonly radiusRaw: number;
+};
+
+declare type GeometrySource = {
+    readonly _tag: 'GeometrySource';
+    readonly kind: 'cms';
+    readonly key: string;
+    readonly channel: string;
+} | {
+    readonly _tag: 'GeometrySource';
+    readonly kind: 'imported';
+    readonly directory: string;
+} | {
+    readonly _tag: 'GeometrySource';
+    readonly kind: 'procedural';
+    readonly seed: number;
+    readonly generator: GeometryGenerator;
+};
+
+declare interface GeometryTileCellBounds {
+    readonly minXRaw: number;
+    readonly minYRaw: number;
+    readonly maxXRaw: number;
+    readonly maxYRaw: number;
+}
+
+declare type GeometryTileChunk = (typeof GeometryTileChunkSchema)["Type"];
+
+declare const GeometryTileChunkSchema: Schema.Struct<{
+    readonly kind: Schema.Literal<"2d-tiles">;
+    readonly formatVersion: Schema.Literal<1>;
+    readonly address: Schema.Struct<{
+        readonly worldId: Schema.String;
+        readonly layerSetId: Schema.String;
+        readonly cx: Schema.Int;
+        readonly cy: Schema.Int;
+    }>;
+    readonly version: Schema.String;
+    readonly width: Schema.Int;
+    readonly height: Schema.Int;
+    readonly tileSizeRaw: Schema.Int;
+    readonly palette: Schema.$Array<Schema.Struct<{
+        readonly key: Schema.String;
+        readonly solid: Schema.Boolean;
+    }>>;
+    readonly runs: Schema.$Array<Schema.Struct<{
+        readonly paletteIndex: Schema.Int;
+        readonly length: Schema.Int;
+    }>>;
+}>;
+
+declare interface GeometryTileCollisionOptions {
+    /** Total visited cells across every solver query, including its final check.
+     * May only narrow the world's maxOverlapTests. */
+    readonly maxTests?: number;
+    /** Existing discrete solver limit; defaults to 8, maximum 256. */
+    readonly maxIterations?: number;
+}
+
+declare interface GeometryTileLimits {
+    readonly maxSide: number;
+    readonly maxCells: number;
+    readonly maxPalette: number;
+    readonly maxRuns: number;
+    readonly maxBytes: number;
+}
+
+declare type GeometryTileMaterial = (typeof GeometryTileMaterialSchema)["Type"];
+
+declare const GeometryTileMaterialSchema: Schema.Struct<{
+    readonly key: Schema.String;
+    readonly solid: Schema.Boolean;
+}>;
+
+declare interface GeometryTileView {
+    readonly chunk: GeometryTileChunk;
+    /** Local integer cell queries. Outside cells refuse; no missing-neighbor air. */
+    materialAt(x: number, y: number): GeometryTileMaterial;
+    solidAt(x: number, y: number): boolean;
+    materialAtRaw(xRaw: number, yRaw: number): GeometryTileMaterial;
+    cellBounds(x: number, y: number): GeometryTileCellBounds;
+    /** Detached row-major little-bit occupancy, never the retained mutable grid. */
+    occupancy(): Uint8Array;
+}
+
+declare interface GeometryVersionActivation {
+    readonly _tag: 'GeometryVersionActivation';
+    readonly receipts: ReadonlyArray<GeometryMigrationReceipt>;
+}
+
+declare interface GeometryVersionMigrationStrategies {
+    readonly migrateDelta?: GeometryMigrateDelta;
+}
+
+declare type GeometryVoxelChunk = (typeof GeometryVoxelChunkSchema)["Type"];
+
+declare const GeometryVoxelChunkSchema: Schema.Struct<{
+    readonly kind: Schema.Literal<"3d-voxel">;
+    readonly formatVersion: Schema.Literal<1>;
+    readonly address: Schema.Struct<{
+        readonly worldId: Schema.String;
+        readonly layerSetId: Schema.String;
+        readonly cx: Schema.Int;
+        readonly cy: Schema.Int;
+        readonly cz: Schema.Int;
+    }>;
+    readonly version: Schema.String;
+    readonly side: Schema.Int;
+    readonly voxelSizeRaw: Schema.Int;
+    readonly palette: Schema.$Array<Schema.Struct<{
+        readonly key: Schema.String;
+        readonly solid: Schema.Boolean;
+    }>>;
+    readonly sections: Schema.$Array<Schema.Struct<{
+        readonly sx: Schema.Int;
+        readonly sy: Schema.Int;
+        readonly sz: Schema.Int;
+        readonly runs: Schema.$Array<Schema.Struct<{
+            readonly paletteIndex: Schema.Int;
+            readonly length: Schema.Int;
+        }>>;
+    }>>;
+}>;
+
+declare interface GeometryVoxelLimits {
+    readonly maxSide: number;
+    readonly maxVoxels: number;
+    readonly maxPalette: number;
+    readonly maxSections: number;
+    readonly maxRunsPerSection: number;
+    readonly maxBytes: number;
+}
+
+declare interface GeometryVoxelView {
+    readonly chunk: GeometryVoxelChunk;
+    materialAt(x: number, y: number, z: number): GeometryTileMaterial;
+    solidAt(x: number, y: number, z: number): boolean;
+    materialAtRaw(xRaw: number, yRaw: number, zRaw: number): GeometryTileMaterial;
+    occupancy(): Uint8Array;
+}
+
+/** Nonempty half-open raw box. Three-dimensional kinds require both Z fields. */
+declare interface GeometryWorldBoxRaw {
+    readonly minXRaw: number;
+    readonly minYRaw: number;
+    readonly maxXRaw: number;
+    readonly maxYRaw: number;
+    readonly minZRaw?: number;
+    readonly maxZRaw?: number;
+}
+
+declare interface GeometryWorldPointRaw {
+    readonly xRaw: number;
+    readonly yRaw: number;
+    readonly zRaw?: number;
+}
+
+declare type GeometryWorldRayHit = GeometryGridRayHit | GeometryShapeRayHit | GeometryHeightfieldRayHit;
+
+declare interface GeometryWorldRayOptions extends GeometryGridRayOptions {
+    /** Shapes only; narrows maxOverlapTests for the total shape scan. */
+    readonly maxTests?: number;
+}
+
+declare interface GeometryWorldShapeHit {
+    readonly scope: GeometryPersistenceScope;
+    readonly revision: number;
+    readonly shape: GeometryShape;
+}
+
+declare interface GeometryWorldView {
+    readonly kind: GeometryKind;
+    readonly scope: GeometryPreparedScope;
+    /** Discrete AABB/circle resolution in world units against current tile data.
+     * Reuses the Transform solver; no swept movement or velocity integration. */
+    collide(transform: Transform2D, body: CollisionBody2D, options?: GeometryTileCollisionOptions): CollisionResult2D;
+    /** Tiles/voxels only. Unloaded coordinates refuse, never implicit empty terrain. */
+    materialAtRaw(point: GeometryWorldPointRaw): GeometryTileMaterial;
+    /** Tiles/voxels/shapes: the stored solidity. Heightfields (points with `zRaw`): terrain is solid at and
+     * below its surface, the same surface `raycastRaw` hits. Heightfield material is not invented. */
+    solidAtRaw(point: GeometryWorldPointRaw): boolean;
+    /** Heightfield only, with exact existing native interpolation. */
+    heightAtRaw(point: GeometryWorldPointRaw): number;
+    /** Shapes only; hit volumes retain native LOCAL coordinates and exact chunk scope. */
+    shapesAtRaw(point: GeometryWorldPointRaw): ReadonlyArray<GeometryWorldShapeHit>;
+    /** Tiles/voxels return exact rational entry; shapes select exact quadratic
+     * entry and expose enclosing presentation bounds; heightfields (points with
+     * `zRaw`) return the first sampled point at or below the surface, refined to
+     * one raw unit (`raycastGeometryHeightfield`). Missing coverage refuses. */
+    raycastRaw(from: GeometryWorldPointRaw, to: GeometryWorldPointRaw, options?: GeometryWorldRayOptions): GeometryWorldRayHit | null;
+    /** Tiles/voxels/closed native shapes, clipped by half-open chunk ownership. Heightfields need the z extent:
+     * the box touches terrain when the highest surface point over its footprint is at or above `minZRaw`
+     * (`overlapsGeometryHeightfieldBox`). Nonempty half-open raw boxes only; missing data or work exhaustion refuses. */
+    overlapsBoxRaw(box: GeometryWorldBoxRaw, options?: GeometryBoxOverlapOptions): boolean;
+    /** Translation-only tile/voxel sweep. Shares maxOverlapTests; validates the
+     * whole swept bounding region before publishing the earliest overlap. */
+    sweepBoxRaw(from: GeometryWorldBoxRaw, to: GeometryWorldBoxRaw, options?: GeometryBoxOverlapOptions): GeometryGridSweepHit | null;
+    /** Heightfields only (boxes with a z extent): the first raw-grid position that reaches under the surface
+     * (`sweepGeometryHeightfieldBox`), coarse steps of a quarter sample spacing, at most
+     * `geometry.budgets.maxRayCells` overlap evaluations of `maxTests` reads each. */
+    sweepHeightfieldBoxRaw(from: GeometryHeightfieldBoxRaw, to: GeometryHeightfieldBoxRaw, options?: GeometryBoxOverlapOptions): GeometryHeightfieldSweepHit | null;
+}
+
+/** Narrow actor seam; transport and persistence are owned outside this loop. */
+declare interface HostedRoom {
+    readonly id: string;
+    advance(): number;
+    dispose(): void;
+    isDisposed(): boolean;
+    isRetiring?(): boolean;
+    drainOutbox(): ReadonlyArray<RoomOutboxCommand>;
+    metrics(): RoomActorMetrics;
+}
+
+declare type LockstepClientFrame = Extract<RoomFrame, {
+    readonly kind: 'LsInput' | 'LsHash';
+}>;
+
+declare type LockstepDesyncAction = 'resync' | 'end' | 'flag';
+
+declare interface LockstepDesyncContext {
+    readonly tick: number;
+    readonly playerId: number;
+    readonly expected: Uint64Words;
+    readonly received: Uint64Words;
+}
+
+declare type LockstepInputPrediction<I> = 'repeat-last' | 'none' | ((last: I, context: {
+    readonly playerId: number;
+    readonly tick: number;
+}) => I);
+
+declare interface LockstepPolicyStrategies {
+    readonly refereeLag?: (configuredTicks: number) => number;
+    readonly stallPolicy?: (options: LockstepStallPolicyOptions) => LockstepStallPolicy;
+    readonly onDesync?: (incident: LockstepDesyncContext, configuredAction: LockstepDesyncAction) => LockstepDesyncAction;
+}
+
+declare type LockstepServerFrame = Extract<RoomFrame, {
+    readonly kind: 'LsStart' | 'LsInputs' | 'LsStall' | 'LsDesync' | 'LsJoin';
+}>;
+
+declare interface LockstepSessionBinding {
+    readonly receive: (frame: LockstepClientFrame) => undefined;
+    readonly tick: () => number;
+}
+
+declare type LockstepStallDecision = {
+    readonly _tag: 'waiting';
+    readonly tick: number;
+    readonly elapsedTicks: number;
+    readonly waitingFor: Uint64Words;
+} | {
+    readonly _tag: 'action';
+    readonly tick: number;
+    readonly elapsedTicks: number;
+    readonly waitingFor: Uint64Words;
+    readonly action: 'pause' | 'drop-player';
+};
+
+declare interface LockstepStallPolicy {
+    readonly afterTicks: number;
+    readonly action: 'pause' | 'drop-player';
+}
+
+declare interface LockstepStallPolicyOptions {
+    readonly afterTicks?: number;
+    readonly action?: 'pause' | 'drop-player';
+}
+
+/** PCG-XSH-RR 64/32. Numeric seeds are unsigned 32-bit; word seeds retain 64 bits.
+ * Algorithm reference: https://www.pcg-random.org/using-pcg-c-basic.html
+ * No global generator, BigInt, native dependency or implicit time/entropy seed. */
+declare class Pcg32 {
+    #private;
+    constructor(seed: Pcg32Seed, stream?: Pcg32Seed, maxRejectionAttempts?: number);
+    get maxRejectionAttempts(): number;
+    nextU32(): number;
+    /** Rejection removes modulo bias. Exhaustion consumes exactly the bounded
+     * draws and fails; it never returns a biased fallback or substitutes entropy. */
+    bounded(bound: number): number;
+    snapshot(): Pcg32Snapshot;
+    restore(offered: Pcg32Snapshot): void;
+    clone(): Pcg32;
+    /** Exact skip-ahead modulo 2^64; at most 32 iterations for this delta API. */
+    advance(delta: number): void;
+}
+
+declare type Pcg32Seed = number | Uint64Words;
+
+declare interface Pcg32Snapshot {
+    readonly stateHi: number;
+    readonly stateLo: number;
+    readonly incrementHi: number;
+    readonly incrementLo: number;
+}
+
+declare interface PreparedCommon {
+    readonly scope: GeometryPersistenceScope;
+    readonly revision: number;
+    readonly blobSha256: string;
+    readonly contentSha256: string;
+    readonly accountedBytes: number;
+}
+
+declare class ProtocolError extends ProtocolError_base {
+    get message(): string;
+}
+
+declare const ProtocolError_base: Schema.Class<ProtocolError, Schema.TaggedStruct<"ProtocolError", {
+    readonly detail: Schema.String;
+}>, YieldableError>;
+
+/** Reconstruct the actual existing authority role from retained SQL intentions.
+ * All real Session evidence must match current scope and historical Subject/ID.
+ * Borrowed Sessions are never closed or activated here. No routing/lease claimed. */
+export declare const rebuildRoomLockstepAuthorityFromSql: <S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(simulation: Simulation<S, I, O>, offeredScope: RoomLockstepRosterScope, offered: RoomLockstepAuthorityRebuildOptions) => Effect.Effect<RoomLockstepAuthorityRebuild<S, I, O>, ProtocolError, RoomLockstepJournalPort>;
+
+/** Reconstruct a fresh private CPU runner; no Session, host or input authority. */
+export declare const rebuildRoomLockstepFromSql: <S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(simulation: Simulation<S, I, O>, scope: RoomLockstepRosterScope, options: RoomLockstepJournalRebuildOptions) => Effect.Effect<RoomLockstepJournalRebuild<S["Type"], O["Type"]>, ProtocolError, RoomLockstepJournalPort>;
+
+/** One authoritative actor. This module contains no store, socket or timer. */
+declare class RoomActor<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> {
+    readonly id: string;
+    readonly descriptor: RoomDescriptor<S, I, O>;
+    private readonly clock;
+    readonly tenantId: string;
+    private currentState;
+    private lastGoodState;
+    private lastGoodTick;
+    readonly options: (O)["Type"];
+    private readonly members;
+    private readonly grace;
+    private readonly inputs;
+    private readonly outbox;
+    private readonly clientOperations;
+    private readonly schedules;
+    private readonly extensionDurationMs;
+    private readonly extensionOverruns;
+    private tick;
+    private droppedTicks;
+    private commandSeq;
+    readonly epoch: number;
+    private nextTickAt;
+    private emptyAt;
+    private locked;
+    private disposed;
+    private publicationHeldAt;
+    private drainFrozen;
+    private drainAt;
+    private retiring;
+    private faulted;
+    private ticking;
+    private lastNow;
+    private readonly app;
+    private readonly scheduler;
+    private readonly worldPreviews;
+    private readonly worldReceipts;
+    private readonly deferredWorldLeaves;
+    private worldMovement;
+    private worldMovementClamps;
+    private worldMovementMargin;
+    private worldMovementIntents;
+    private worldFinalizationHold;
+    private readonly worldPublishedTransitions;
+    private lifecycleTail;
+    private lifecycleRequests;
+    private lifecycleActive;
+    private readonly geometry;
+    constructor(id: string, descriptor: RoomDescriptor<S, I, O>, initialState: (S)["Type"], options: (O)["Type"], clock: RoomClock, tenantId: string, recovery?: RoomActorRecovery, geometry?: GeometryWorldView);
+    get state(): RoomState<(S)["Type"]>;
+    private now;
+    private ensureOpen;
+    private stage;
+    private schedule;
+    join(client: RoomClient): void;
+    joinAsync(client: RoomClient, signal?: AbortSignal): Promise<void>;
+    /** Only a trusted SQL seat adapter supplies this cursor; player Hello/input
+     * never contains it. The successful lifecycle commits cursor and membership. */
+    /** `authorizeCommit` runs before the join hook and again before publication; the World
+     * member its first run returns reaches `onJoin` as `world`. */
+    joinReservedAsync(client: RoomClient, consumed: RoomConsumedSeat, signal?: AbortSignal, authorizeCommit?: () => Promise<RoomWorldMember | undefined | void>): Promise<void>;
+    /** Trusted Host-only pending membership. The caller must separately establish
+     * current SQL transition/Seat authority; the marker itself grants nothing. */
+    joinWorldReservedAsync(client: RoomClient, consumed: RoomConsumedSeat, authorize: () => Promise<void | 'pending' | 'committed' | 'settled'>, signal?: AbortSignal): Promise<void>;
+    /** The author's view of a transition arrival becoming an active member (`world.onMemberEnter`). */
+    private worldMemberEntered;
+    /** The committed World point of one entity through `world.movement.position`: the last good state, never a
+     * draft. Null without a movement hook, without that entity, or without a finite point. */
+    worldEntityPoint(entityId: string): WorldPoint | null;
+    /** Release only after the Host has persisted actual target enter and rechecked
+     * SQL authority. The retained canonical enter receipt is required locally. */
+    activateWorldReservedAsync(binding: WorldTargetSeatBinding, authorize: () => Promise<void>): Promise<void>;
+    private assertWorldMemberEntity;
+    isWorldPending(sessionId: string): boolean;
+    /** Explicit trusted local-host admission. Authentication still follows the
+     * descriptor; the resulting capability is bound to this exact Member object,
+     * so a stale bot cannot submit to or release a later reused session ID. */
+    joinBotAsync(client: RoomClient, countsAsPlayer?: boolean, signal?: AbortSignal): Promise<RoomActorBotLease>;
+    playerCount(): number;
+    availablePlayerSlots(): number;
+    monotonicNow(): number;
+    roster(): ReadonlyArray<Pick<RoomClient, 'sessionId' | 'subjectId' | 'tenantId'> & {
+        readonly isBot: boolean;
+        readonly countsAsPlayer: boolean;
+    }>;
+    /** Check identity/lock and current counted/grace capacity before replacing a
+     * bot. Full prepareJoin repeats these immediately before membership commit. */
+    humanAdmissionNeedsReplacement(client: RoomClient): boolean;
+    private prepareClientIdentity;
+    private prepareJoin;
+    leave(sessionId: string, reason?: RoomLeaveReason): void;
+    leaveAsync(sessionId: string, reason?: RoomLeaveReason, signal?: AbortSignal): Promise<void>;
+    private prepareLeave;
+    private assertWorldArrival;
+    private enterWorldDraft;
+    /** Execute actual target admission on an isolated draft. Nothing is published
+     * or receipted here. Author Effects receive prepare phase and must supply their
+     * own external idempotency/compensation; this is not an ownership commit. */
+    previewWorldEnter(input: Parameters<RoomActor<S, I, O>['applyWorldHook']>[1], maxBytes: number, signal?: AbortSignal): Promise<void>;
+    /** Trusted server lifecycle only. The caller supplies the configured World
+     * byte budget and current epoch; this grants no SQL/transition admission. */
+    applyWorldHook(operation: 'enter' | 'exit' | 'ghost', input: RoomWorldHookInput<RoomWorldEntity<(S)["Type"]>>, maxBytes: number, signal?: AbortSignal, authorizeCommit?: () => Promise<void>, replaceExitReceipt?: boolean, previousGhost?: RoomWorldHookInput<RoomWorldEntity<(S)["Type"]>>, retainGhostProjection?: boolean, promoteGhosts?: ReadonlyArray<RoomWorldHookInput<RoomWorldEntity<(S)["Type"]>>>): Promise<void>;
+    private assertWorldHookResult;
+    private assertWorldEnterVacant;
+    /** Trusted Host terminal-proof path only; it checkpoints the removal before
+     * returning. No gameplay state or external effect is undone here. */
+    retireWorldReceipt(requestId: string, operation: 'enter' | 'exit' | 'ghost'): Promise<void>;
+    /** Failed transition compensation, guarded before draft publication. The
+     * author removes its projection in onGhost phase rollback; no source rewind. */
+    cancelWorldGhost(input: Parameters<RoomActor<S, I, O>['applyWorldHook']>[1], maxBytes: number, authorize: () => Promise<void>): Promise<void>;
+    cancelWorldPreview(requestId: string, authorize: () => Promise<void>): Promise<void>;
+    hasWorldReceipt(requestId: string, operation: 'enter' | 'exit' | 'ghost'): boolean;
+    worldReceiptSnapshot(): ReadonlyArray<RoomWorldReceipt>;
+    /** Capture the actual current actor entity, never a caller-provided replacement.
+     * Returned data is detached bounded JSON; persistence remains outside the tick. */
+    captureWorldEntity(entityId: string, epoch: number, maxBytes: number): Promise<{
+        readonly entity: RoomWorldEntity<(S)["Type"]>;
+        readonly data: unknown;
+    }>;
+    configureWorldCellMovement(epoch: number, bounds?: WorldBounds, marginUnits?: number): Promise<void>;
+    worldMovementSnapshot(): {
+        readonly bound: boolean;
+        readonly clamped: number;
+    };
+    captureWorldMovement(epoch: number): Promise<WorldMovementObservation>;
+    private constrainWorldMovement;
+    listWorldEntityIds(epoch: number, maximum: number, maxBytes: number): Promise<ReadonlyArray<string>>;
+    captureWorldProjection(entityId: string, epoch: number, maxBytes: number): Promise<{
+        readonly entity: RoomWorldEntity<(S)["Type"]>;
+        readonly data: unknown;
+        readonly tick: number;
+    }>;
+    private captureWorldEntityOwned;
+    /** Trusted Host handoff: one bounded room hold survives ambiguous durable writes.
+     * Completion must follow checkpoint acknowledgement; never release by timeout. */
+    finalizeWorldExit(input: {
+        readonly afterglow?: {
+            readonly requestId: string;
+            readonly expiresAt: number;
+        };
+        readonly subjectId?: string;
+        readonly epoch: number;
+        readonly entityId: string;
+        readonly requestId: string;
+        readonly location: WorldEntityLocation;
+    }, maxBytes: number, retain: (capture: {
+        readonly entity: RoomWorldEntity<(S)["Type"]>;
+        readonly data: unknown;
+    }) => Promise<void>, authorize: () => Promise<void>, expectedEntity?: unknown, signal?: AbortSignal): Promise<void>;
+    /** The actual Runtime supplies the synchronous bounded reliable enqueue. No
+     * network completion is awaited while the lifecycle/SQL fence is held. */
+    notifyWorldHandoff(input: Omit<RoomWorldHandoffFrame, 'tick'>, authorize: () => Promise<void>, enqueue: (frame: RoomWorldHandoffFrame) => void): Promise<void>;
+    /** Only the actual Host may call this after its durable checkpoint succeeds. */
+    completeWorldFinalization(requestId: string, authorize: () => Promise<void>): Promise<void>;
+    worldFinalizationAfterglow(): {
+        readonly requestId: string;
+        readonly expiresAt: number;
+    } | undefined;
+    worldFinalizationRequest(): string | null;
+    isWorldFinalizationHeld(): boolean;
+    /** Recovery-only source reconstruction from final durable capture. Caller owns
+     * unpublished successor/recovery authority and checkpoints before fence clear. */
+    reconcileWorldSource(input: {
+        readonly epoch: number;
+        readonly requestId: string;
+        readonly entity: RoomWorldEntity<(S)["Type"]>;
+        readonly location: WorldEntityLocation;
+    }, maxBytes: number, authorize: () => Promise<void>, signal?: AbortSignal): Promise<void>;
+    private assertSynchronousLifecycle;
+    private serializeLifecycle;
+    private mutateMemberAsync;
+    private pruneGrace;
+    private mutateMember;
+    /** encodedBytes is measured by the host transport, never supplied by a player. */
+    input(sessionId: string, seq: number, tickHint: number, payload: unknown, encodedBytes: number): boolean;
+    private send;
+    private extension;
+    holdPublication(): void;
+    releasePublication(): void;
+    /** Called by the host's single monotonic loop. Catch-up never spins unbounded. */
+    advance(): number;
+    drainOutbox(): ReadonlyArray<RoomOutboxCommand>;
+    private stageClientOperation;
+    /** Transport callbacks are invoked only by the supervisor after advance. */
+    flushClientOperations(): void;
+    /** Ordinary socket members and reconnect grace only. Local bots own no SQL
+     * seat. Queued-but-unapplied inputs never become applied receipts; discarded
+     * pending World inputs carry a separate durable rejection cursor. */
+    inputReceiptSnapshot(): ReadonlyArray<RoomInputReceipt>;
+    /** Runtime-only confirmation after the actual checkpoint port acknowledges.
+     * Inputs arriving during the write remain unconfirmed and block activation. */
+    confirmInputCheckpoint(receipts: ReadonlyArray<RoomInputReceipt>): void;
+    lastAppliedInputSeq(sessionId: string): number;
+    lock(): void;
+    unlock(): void;
+    dispose(): void;
+    isDisposed(): boolean;
+    isLifecycleBusy(): boolean;
+    /** Permanent local simulation fence before the final planned-handoff snapshot. */
+    freezeForDrain(): Promise<void>;
+    /** Only after real SQL ownership handoff. No leave/dispose game hooks, SQL,
+     * or new commands may run after the saved state has moved to its successor. */
+    releaseTransferred(): void;
+    disposeAsync(signal?: AbortSignal): Promise<void>;
+    isRetiring(): boolean;
+    /** Only the supervisor calls this after the final hibernated SQL receipt.
+     * Hibernate pauses a durable room; it must not run game-ending onDispose. */
+    releaseHibernated(): void;
+    isFaulted(): boolean;
+    commandCursor(): number;
+    scheduleSnapshot(): ReadonlyArray<RoomScheduleSnapshot>;
+    lastGoodSnapshot(): {
+        readonly tick: number;
+        readonly state: RoomState<(S)["Type"]>;
+    };
+    metrics(): RoomActorMetrics;
+}
+
+declare interface RoomActorBotLease {
+    readonly sessionId: string;
+    isCurrent(): boolean;
+    input(seq: number, tickHint: number, payload: unknown, encodedBytes: number): boolean;
+    leave(signal?: AbortSignal): Promise<void>;
+}
+
+declare interface RoomActorMetrics {
+    readonly tick: number;
+    readonly droppedTicks: number;
+    readonly queuedInputs: number;
+    readonly outboxCommands: number;
+    readonly clients: number;
+    readonly extensionDurationMs: Readonly<Record<string, number>>;
+    readonly extensionOverruns: Readonly<Record<string, number>>;
+}
+
+declare interface RoomActorRecovery {
+    /** SQL ownership generation; a new owner must use a strictly newer epoch. */
+    readonly epoch: number;
+    readonly commandCursor: number;
+    readonly tick?: number;
+    readonly rehydrate?: boolean;
+    readonly worldReceipts?: ReadonlyArray<RoomWorldReceipt> | undefined;
+    readonly schedules?: ReadonlyArray<RoomScheduleSnapshot>;
+}
+
+/** Commands are staged in memory and drained outside the tick. */
+declare interface RoomAppBridge {
+    publish(event: string, payload: unknown, options: {
+        readonly key: string;
+    }): string;
+    run(descriptor: string, input: unknown): string;
+}
+
+declare interface RoomAuthoringStrategies<S = unknown> {
+    readonly budgets?: (options: Readonly<Partial<RoomBudgets>>) => RoomBudgets;
+    readonly reconnectPolicy?: (options: Readonly<Partial<{
+        readonly graceMs: number;
+    }>>) => {
+        readonly graceMs: number;
+    };
+    readonly snapshotPolicy?: (options: Readonly<Partial<RoomSnapshotPolicy<S>>>) => RoomSnapshotPolicy<S>;
+    readonly spectatorPolicy?: (options: Readonly<Partial<RoomSpectatorPolicy>>) => RoomSpectatorPolicy;
+}
+
+declare interface RoomBudgets {
+    readonly inputsPerSecond: number;
+    readonly bytesPerSecond: number;
+    readonly burst: number;
+    readonly maxQueuedInputs: number;
+    readonly maxOutboxCommands: number;
+    readonly maxScheduledHooks: number;
+    readonly maxQueuedLifecycleHooks: number;
+    readonly maxNpcs: number;
+    /** A player input acting on state older than this many milliseconds behind the newest state
+     * the Host sent that client is dropped (it arrived too late to apply fairly). */
+    readonly inputLatencyBudgetMs: number;
+}
+
+declare interface RoomChannel {
+    readonly schema: Schema.Codec<unknown, unknown>;
+    readonly direction: 'both' | 'server' | 'client';
+    readonly reliable: boolean;
+}
+
+declare interface RoomCheckpoint {
+    readonly requestId: string;
+    readonly roomId: string;
+    readonly tenantId: string;
+    readonly epoch: number;
+    readonly revision: number;
+    readonly tick: number;
+    readonly commandCursor: number;
+    readonly bytes: Uint8Array;
+    readonly schemaHash: number;
+    readonly schedules: ReadonlyArray<RoomScheduleSnapshot>;
+    readonly worldReceipts?: ReadonlyArray<RoomWorldReceipt> | undefined;
+    readonly inputReceipts: ReadonlyArray<RoomInputReceipt>;
+    readonly commands: ReadonlyArray<RoomOutboxCommand>;
+    readonly publication?: 'held' | undefined;
+    /** Earliest World epoch represented by an interrupted held adoption. */
+    readonly worldRecoveryEpoch?: number | undefined;
+    readonly disposition: 'live' | 'faulted' | 'disposed' | 'hibernating' | 'hibernated';
+    /** The Room's own listing (`RoomDefinition.listing`), written to the directory with a live checkpoint. */
+    readonly listing?: RoomListing | undefined;
+    readonly snapshot?: {
+        readonly mode: 'full' | 'delta';
+        readonly fullEvery: number;
+        readonly keepFulls: number;
+        readonly store: 'auto';
+        readonly maxInlineBytes: number;
+    };
+}
+
+/** Browser-safe service contracts. Server adapters and fixture Layers share
+ * these exact Tags; imports of server-owned data shapes are erased types. */
+declare class RoomCheckpointPort extends RoomCheckpointPort_base {
+}
+
+declare const RoomCheckpointPort_base: Context.ServiceClass<RoomCheckpointPort, "@voltro/RoomCheckpointPort", {
+    commit(checkpoint: RoomCheckpoint): Effect.Effect<void, ProtocolError | RoomHibernatePending>;
+    load(roomId: string, tenantId: string): Effect.Effect<RoomCheckpoint | null, ProtocolError>;
+    pending(roomId: string, tenantId: string, limit: number): Effect.Effect<ReadonlyArray<RoomOutboxCommand>, ProtocolError>;
+    acknowledge(roomId: string, tenantId: string, requestId: string): Effect.Effect<void, ProtocolError>;
+    /** Optional: retire a command whose handler keeps failing (marked failed, no longer pending).
+     * Without it, a failing command is retried on every turn. */
+    readonly park?: (roomId: string, tenantId: string, requestId: string) => Effect.Effect<void, ProtocolError>;
+}>;
+
+declare interface RoomClient {
+    readonly sessionId: string;
+    readonly subjectId: string | null;
+    readonly tenantId: string;
+    /** App data the API resolved for this seat (`seatAttributes` on the Rooms API binding), signed into
+     * the seat; absent without one. Not a secret from the player: it travels in their seat token. */
+    readonly attributes?: RoomSeatAttributes | undefined;
+    /** Actor-owned classification, never accepted from a socket input. */
+    readonly isBot?: boolean | undefined;
+    readonly countsAsPlayer?: boolean | undefined;
+    send(channel: string, payload: unknown): void;
+    kick(reason: string): void;
+}
+
+declare interface RoomClock {
+    now(): number;
+}
+
+declare interface RoomCodecLimits {
+    readonly maxBytes: number;
+    readonly maxCollectionLength: number;
+    readonly maxFieldId: number;
+}
+
+declare interface RoomConsumedSeat {
+    readonly lastAppliedSeq: number;
+    readonly discardedThrough?: number;
+    readonly worldTarget?: WorldTargetSeatBinding;
+}
+
+declare interface RoomDatagramLane {
+    readonly maxDatagramBytes: number;
+    send(frame: Uint8Array): void;
+    onFrame(listener: (frame: Uint8Array, receivedAt: number) => void): () => void;
+}
+
+declare interface RoomDefinition<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> {
+    readonly name: string;
+    readonly mode?: 'state-sync';
+    readonly state: S;
+    readonly auth?: 'subject' | 'public';
+    readonly guards?: DeclaredAccess;
+    readonly openAccess?: string | undefined;
+    readonly input: I;
+    readonly options: O;
+    /** Author-owned initial state; no game values are guessed by the host. */
+    readonly initialState?: (options: (O)["Type"]) => (S)["Type"];
+    readonly tickRate?: number;
+    readonly sendRate?: number;
+    readonly maxClients?: number;
+    readonly maxCatchUpTicks?: number;
+    readonly lifecycleTimeoutMs?: number;
+    readonly budgets?: Partial<RoomBudgets>;
+    readonly strategies?: RoomAuthoringStrategies<(S)["Type"]> | undefined;
+    readonly reconnect?: {
+        readonly graceMs: number;
+    };
+    readonly autoDispose?: {
+        readonly afterEmptyMs: number;
+        readonly hibernate?: boolean;
+    };
+    readonly snapshot?: Partial<RoomSnapshotPolicy<(S)["Type"]>>;
+    /** Opt-in shared history; host must supply the actual common view/admission. */
+    readonly spectator?: Partial<RoomSpectatorPolicy> | undefined;
+    readonly messages?: Readonly<Record<string, RoomChannel>>;
+    readonly view?: (context: RoomViewContext<(S)["Type"]>) => (S)["Type"];
+    readonly viewBudgetMs?: number;
+    /** How the Room appears in `rooms.list`, derived from its state: `private` takes it off the list
+     * (it stays joinable by ID), `locked` refuses every new seat, `metadata` is shown to listers.
+     * Omitted fields keep their current value. The Host writes a change with the next checkpoint,
+     * which a change triggers at once. Synchronous and pure, like `view`. */
+    readonly listing?: (context: RoomListingContext<(S)["Type"], (O)["Type"]>) => RoomListing;
+    readonly extensions?: ReadonlyArray<RoomExtension<(S)["Type"], (I)["Type"]>>;
+    readonly world?: RoomWorldHooks<(S)["Type"]> | undefined;
+    readonly onCreate?: RoomSyncHook<Omit<RoomMemberContext<(S)["Type"], (O)["Type"]>, 'client'>>;
+    readonly onRehydrate?: RoomSyncHook<Omit<RoomMemberContext<(S)["Type"], (O)["Type"]>, 'client'>>;
+    readonly onJoin?: RoomLifecycleHook<RoomMemberContext<(S)["Type"], (O)["Type"]>>;
+    readonly onLeave?: RoomLifecycleHook<RoomMemberContext<(S)["Type"], (O)["Type"]> & {
+        readonly reason: RoomLeaveReason;
+    }>;
+    readonly onTick: RoomSyncHook<RoomTickContext<(S)["Type"], (I)["Type"]>>;
+    readonly onSchedule?: RoomSyncHook<RoomTickContext<(S)["Type"], (I)["Type"]> & {
+        readonly label: string;
+    }>;
+    readonly onDispose?: RoomLifecycleHook<{
+        readonly state: RoomState<(S)["Type"]> | undefined;
+        readonly app: RoomAppBridge;
+        readonly geometry?: GeometryWorldView;
+    }> | undefined;
+}
+
+declare interface RoomDescriptor<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> extends RoomDefinition<S, I, O> {
+    readonly _tag: 'RoomDescriptor';
+    readonly auth: 'subject' | 'public';
+    readonly guards: DeclaredAccess;
+    readonly tickRate: number;
+    readonly sendRate: number;
+    readonly maxClients: number;
+    readonly maxCatchUpTicks: number;
+    readonly lifecycleTimeoutMs: number;
+    readonly budgets: RoomBudgets;
+    readonly view: (context: RoomViewContext<(S)["Type"]>) => (S)["Type"];
+    readonly reconnect: {
+        readonly graceMs: number;
+    };
+    readonly autoDispose: {
+        readonly afterEmptyMs: number;
+        readonly hibernate: boolean;
+    };
+    readonly snapshot: RoomSnapshotPolicy<(S)["Type"]>;
+    readonly spectator?: RoomSpectatorPolicy | undefined;
+    readonly messages: Readonly<Record<string, RoomChannel>>;
+    readonly viewBudgetMs: number;
+    readonly extensions: ReadonlyArray<RoomExtension<(S)["Type"], (I)["Type"]>>;
+}
+
+/** Exact last committed boundary supplied by the quiesced local owner. No client RPC. */
+declare type RoomDrainHandoff = RoomDrainRoom & ({
+    readonly mode: 'state-sync';
+    readonly revision: number;
+} | {
+    readonly mode: 'lockstep';
+    readonly admissionDigest: string;
+    readonly journalDigest: string | null;
+});
+
+declare interface RoomDrainRoom {
+    readonly roomId: string;
+    readonly tenantId: string;
+    readonly epoch: number;
+    readonly tick: number;
+}
+
+declare interface RoomErasureInput {
+    readonly roomId: string;
+    readonly tenantId: string;
+    /** The caller retains this identity across uncertain outcomes and restart. */
+    readonly requestId: string;
+}
+
+/** Whole selected room, not a subject-selection/export policy. */
+declare class RoomErasurePort extends RoomErasurePort_base {
+}
+
+declare const RoomErasurePort_base: Context.ServiceClass<RoomErasurePort, "@voltro/RoomErasurePort", {
+    erase(input: RoomErasureInput): Effect.Effect<void, ProtocolError>;
+}>;
+
+declare interface RoomExtension<S, I> {
+    readonly name: string;
+    readonly fields: ReadonlyArray<Extract<keyof S, string>>;
+    readonly channel: string;
+    readonly tickBudgetMs: number;
+    readonly beforeTick?: RoomSyncHook<RoomExtensionContext<S, I>>;
+    readonly afterTick?: RoomSyncHook<RoomExtensionContext<S, I>>;
+}
+
+declare interface RoomExtensionContext<S, I> {
+    /** Prepared native CPU queries only, installed before actor lifecycle. */
+    readonly geometry?: GeometryWorldView | undefined;
+    readonly state: RoomState<Partial<S>>;
+    readonly tick: number;
+    readonly dt: number;
+    readonly inputs: ReadonlyArray<Omit<RoomInput<I>, 'client'> & {
+        readonly client: Pick<RoomClient, 'sessionId' | 'subjectId' | 'tenantId' | 'isBot' | 'countsAsPlayer' | 'attributes'>;
+    }>;
+    readonly clock: RoomClock;
+    send(sessionId: string, payload: unknown): void;
+}
+
+declare interface RoomFault {
+    readonly roomId: string;
+    readonly tick: number;
+    readonly cause: unknown;
+    /** Ownership is transferred to the supervisor for snapshot/drain/disposal. */
+    readonly room: HostedRoom;
+}
+
+declare class RoomForbidden extends RoomForbidden_base {
+}
+
+declare const RoomForbidden_base: Schema.Class<RoomForbidden, Schema.TaggedStruct<"RoomForbidden", {
+    readonly roomId: Schema.String;
+}>, YieldableError>;
+
+declare type RoomFrame = RoomWorldHandoffFrame | {
+    readonly kind: 'Hello';
+    readonly protocolVersion: number;
+    readonly token: Uint8Array;
+    readonly schemaHash: number;
+    readonly resumeFromTick?: number;
+    readonly transportCaps: number;
+} | {
+    readonly kind: 'Input';
+    readonly firstSeq: number;
+    readonly inputs: ReadonlyArray<{
+        readonly tickHint: number;
+        readonly payload: Uint8Array;
+    }>;
+    readonly ackTick?: number;
+}
+/** `lossPermille`: the client's estimated loss of state datagrams (0–1000), once it has one. */
+| {
+    readonly kind: 'Ack';
+    readonly tick: number;
+    readonly lossPermille?: number;
+} | {
+    readonly kind: 'Ping';
+    readonly clientTimeMs: number;
+} | {
+    readonly kind: 'ClientMessage' | 'ServerMessage';
+    readonly channelId: number;
+    readonly payload: Uint8Array;
+} | {
+    readonly kind: 'Leave';
+    readonly reason: number;
+} | {
+    readonly kind: 'Welcome';
+    readonly sessionId: string;
+    readonly tick: number;
+    readonly serverTimeMs: number;
+    readonly epoch: number;
+    readonly baseline: Uint8Array;
+    readonly transformRules: Uint8Array;
+} | {
+    readonly kind: 'Delta';
+    readonly tick: number;
+    readonly baseTick: number;
+    readonly patch: Uint8Array;
+    readonly inputAck?: RoomFrameInputReceipt;
+} | {
+    readonly kind: 'Full';
+    readonly tick: number;
+    readonly epoch: number;
+    readonly baseline: Uint8Array;
+    readonly inputAck?: RoomFrameInputReceipt;
+} | {
+    readonly kind: 'InputAck';
+    readonly lastAppliedSeq: number;
+    readonly tick: number;
+    readonly flags: number;
+}
+/** `deltaDatagramsSent`: state deltas this Session sent as datagrams so far, for the client's loss estimate. */
+| {
+    readonly kind: 'Pong';
+    readonly clientTimeMs: number;
+    readonly serverTimeMs: number;
+    readonly tick: number;
+    readonly deltaDatagramsSent?: number;
+} | {
+    readonly kind: 'Kick';
+    readonly code: number;
+    readonly reason: string;
+} | {
+    readonly kind: 'Migrate';
+    readonly address?: string;
+    readonly graceMs: number;
+} | {
+    readonly kind: 'Error';
+    readonly code: number;
+    readonly detail: string;
+} | {
+    readonly kind: 'LsInput';
+    readonly firstTick: number;
+    readonly inputs: ReadonlyArray<Uint8Array>;
+} | {
+    readonly kind: 'LsInputs';
+    readonly firstTick: number;
+    readonly matrices: ReadonlyArray<RoomLockstepInputMatrix>;
+} | {
+    readonly kind: 'LsHash';
+    readonly tick: number;
+    readonly hi: number;
+    readonly lo: number;
+} | {
+    readonly kind: 'LsDesync';
+    readonly tick: number;
+    readonly action: 'resync';
+    readonly snapshot: Uint8Array;
+} | {
+    readonly kind: 'LsDesync';
+    readonly tick: number;
+    readonly action: 'end' | 'flag';
+    readonly snapshot?: never;
+} | {
+    readonly kind: 'LsStart';
+    readonly startTick: number;
+    readonly seed: number;
+    readonly options: Uint8Array;
+    readonly serverTimeMs: number;
+    readonly localPlayerId: number;
+    readonly roster: ReadonlyArray<RoomLockstepWirePlayer>;
+    readonly history?: Uint8Array;
+    readonly snapshot?: Uint8Array;
+} | {
+    readonly kind: 'LsStall';
+    readonly waitingFor: RoomLockstepPlayerMask;
+}
+/** A player admitted after Start: from `tick` on, every matrix carries its `slot`. */
+| {
+    readonly kind: 'LsJoin';
+    readonly tick: number;
+    readonly slot: number;
+    readonly playerId: number;
+};
+
+declare interface RoomFrameInputReceipt {
+    readonly lastAppliedSeq: number;
+    readonly flags: number;
+}
+
+declare interface RoomGeometryOwnerScope {
+    readonly roomId: string;
+    readonly tenantId: string;
+    readonly hostId: string;
+    readonly epoch: number;
+    readonly name: string;
+}
+
+declare interface RoomGeometryResource {
+    readonly scope: RoomGeometryOwnerScope;
+    readonly world: AnyWorldDescriptor;
+    readonly inventory: GeometryActorInventory;
+    readonly view: GeometryWorldView;
+    /** Trusted local unsubmitted discard; never a global rejection/SQL receipt. */
+    /** Trusted visibility/source invalidation, queued for the actual Host pump. */
+    invalidateStreams(): void;
+    discardUnsubmitted(target: GeometryPrivacyTarget): Promise<boolean>;
+    /** Writer lifetime only; actual SQL/reader/content erasure stays on the selected source. */
+    withdrawSubject(target: GeometryPrivacyTarget): Promise<void>;
+    eraseSubject(target: GeometryPrivacyTarget): Promise<void>;
+    /** Outside-Tick SQL publication/refresh after the actual Room boundary. */
+    synchronize(): Promise<void>;
+    /** Fence and join both channel graphs without closing the native CPU frame.
+     * Retired graphs stay retired; this alone never installs a new version. */
+    quiesce(): Promise<void>;
+    close(): Promise<void>;
+}
+
+/** Durable work/capacity is still owned; this is backpressure, not completion. */
+declare class RoomHibernatePending extends RoomHibernatePending_base {
+}
+
+declare const RoomHibernatePending_base: Schema.Class<RoomHibernatePending, Schema.TaggedStruct<"RoomHibernatePending", {
+    readonly roomId: Schema.String;
+}>, YieldableError>;
+
+/** Drives all rooms once per host turn; an author's throw cannot stop peers. */
+declare class RoomHost {
+    readonly capacity: number;
+    private readonly rooms;
+    private readonly pendingFaults;
+    private readonly retired;
+    private faults;
+    private ticks;
+    private disposed;
+    private advancing;
+    constructor(capacity: number);
+    add(room: HostedRoom): void;
+    advance(eligible?: (roomId: string) => boolean): number;
+    drainFaults(): ReadonlyArray<RoomFault>;
+    takeRetired(): ReadonlyArray<HostedRoom>;
+    /** A detached inventory for supervision, never available during advance. */
+    activeRooms(): ReadonlyArray<HostedRoom>;
+    /** A supervisor transfers one revoked owner without stopping its peers. */
+    take(roomId: string): HostedRoom | null;
+    /** Shutdown transfers ownership without dropping pending commands. */
+    takeAll(): ReadonlyArray<HostedRoom>;
+    drainOutbox(): ReadonlyArray<{
+        readonly roomId: string;
+        readonly command: RoomOutboxCommand;
+    }>;
+    private outsideTick;
+    metrics(): RoomHostMetrics;
+    dispose(): void;
+}
+
+/** Rolling host tick occupancy. Monotonic milliseconds, never simulation time. */
+declare interface RoomHostLoopSnapshot {
+    readonly from: number;
+    readonly until: number;
+    readonly coverage: 'warming-up' | 'complete' | 'invalid';
+    readonly tickSeconds: number;
+    readonly loopUtilization: number | null;
+    /** Fraction of the same window the Node event loop was busy: ticks plus networking, encoding
+     *  and storage callbacks. What a host's CPU headroom follows; `null` while warming up. */
+    readonly eventLoopUtilization: number | null;
+    readonly clockErrors: number;
+}
+
+declare interface RoomHostMetrics {
+    readonly rooms: number;
+    readonly clients: number;
+    readonly ticks: number;
+    readonly droppedTicks: number;
+    readonly faults: number;
+}
+
+declare interface RoomInput<I> {
+    readonly client: RoomClient;
+    readonly seq: number;
+    readonly tickHint: number;
+    readonly input: I;
+}
+
+/** Captured outside the tick and stored with the exact state it describes. */
+declare interface RoomInputReceipt {
+    readonly sessionId: string;
+    readonly subjectId: string | null;
+    readonly lastAppliedSeq: number;
+    /** Intentionally discarded pending World input; never an applied ACK. */
+    readonly discardedThrough?: number;
+}
+
+declare type RoomLeaveReason = 'left' | 'kicked' | 'reconnecting' | 'timeout' | 'disposed';
+
+/** Lifecycle Effects are run by the host outside the synchronous tick. `void` admits block bodies;
+ * a returned Promise is refused at runtime with an authoring error. */
+declare type RoomLifecycleHook<C> = (context: C) => void | Effect.Effect<void, unknown>;
+
+/** A Room's own listing; scalar metadata only, at most 16 keys and 2 KiB. */
+declare interface RoomListing {
+    readonly metadata?: Readonly<Record<string, RoomScalar>>;
+    readonly private?: boolean;
+    readonly locked?: boolean;
+}
+
+declare interface RoomListingContext<S, O> {
+    readonly state: S;
+    readonly options: O;
+}
+
+export declare interface RoomLockstepAdmission {
+    readonly version: 1;
+    readonly roomId: string;
+    readonly tenantId: string;
+    readonly ownerEpoch: number;
+    readonly hostId: string;
+    readonly initial: {
+        readonly requestId: string;
+        readonly creatorSubjectId: string;
+        readonly name: string;
+        readonly seed: number;
+        readonly options: string;
+        readonly stateSchemaHash: number;
+        readonly inputSchemaHash: number;
+    };
+    readonly adoption: {
+        readonly requestId: string;
+        readonly priorEpoch: number;
+    } | null;
+    readonly digest: string;
+}
+
+export declare const roomLockstepAdmissionLayer: <S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(store: DataStore, descriptor: RoomLockstepDescriptor<S, I, O>, options: RoomLockstepAdmissionStoreOptions) => Layer.Layer<RoomLockstepAdmissionPort>;
+
+/** Trusted complete outside-tick SQL creation capability, never a player state RPC. */
+export declare class RoomLockstepAdmissionPort extends RoomLockstepAdmissionPort_base {
+}
+
+declare const RoomLockstepAdmissionPort_base: Context.ServiceClass<RoomLockstepAdmissionPort, "@voltro/RoomLockstepAdmissionPort", {
+    prepare(input: RoomLockstepCreation): Effect.Effect<RoomLockstepAdmission, ProtocolError>;
+    publish(scope: RoomLockstepRosterScope): Effect.Effect<RoomLockstepAdmission, ProtocolError>;
+    load(scope: RoomLockstepRosterScope): Effect.Effect<RoomLockstepAdmission | null, ProtocolError>;
+    adopt(scope: RoomLockstepRosterScope, priorEpoch: number, requestId: string): Effect.Effect<RoomLockstepAdmission, ProtocolError>;
+    exportSubject(scope: RoomLockstepRosterScope, subjectId: string): Effect.Effect<RoomLockstepCreationExport | null, ProtocolError>;
+    erase(scope: RoomLockstepRosterScope, requestId: string): Effect.Effect<void, ProtocolError>;
+}>;
+
+export declare interface RoomLockstepAdmissionStoreOptions {
+    readonly hostId: string;
+    readonly epochNow: () => number;
+    readonly authorize: (scope: RoomLockstepRosterScope, operation: 'prepare' | 'publish' | 'load' | 'adopt' | 'export' | 'erase', subjectId?: string) => Effect.Effect<void, unknown>;
+    readonly erasure: Context.Service.Shape<typeof RoomErasurePort>;
+    readonly maxAdmissionBytes?: number;
+}
+
+export declare interface RoomLockstepAuthorityRebuild<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> {
+    readonly server: RoomLockstepServer<S, I, O>;
+    readonly scope: RoomLockstepRosterScope;
+    readonly journalDigest: string;
+    readonly replayedTicks: number;
+    readonly inputBytes: number;
+}
+
+export declare interface RoomLockstepAuthorityRebuildOptions extends RoomLockstepJournalRebuildOptions {
+    /** Actual newly/currently welcomed Sessions, explicitly paired with retained IDs. */
+    readonly players: ReadonlyArray<{
+        readonly playerId: number;
+        readonly actualSession: unknown;
+    }>;
+    readonly serverOptions?: RoomLockstepServerOptions;
+}
+
+export declare interface RoomLockstepCreation extends RoomLockstepRosterScope {
+    readonly requestId: string;
+    readonly creatorSubjectId: string;
+    readonly seed: number;
+    readonly options: unknown;
+}
+
+export declare interface RoomLockstepCreationExport {
+    readonly roomId: string;
+    readonly name: string;
+    readonly requestId: string;
+    readonly seed: number;
+    readonly stateSchemaHash: number;
+    readonly inputSchemaHash: number;
+}
+
+declare interface RoomLockstepDefinition<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> {
+    readonly name: string;
+    readonly mode: 'lockstep';
+    readonly simulation: Simulation<S, I, O>;
+    readonly lockstep?: RoomLockstepOptions<I> | undefined;
+    readonly guards?: DeclaredAccess;
+    readonly openAccess?: string | undefined;
+    readonly auth?: 'subject';
+    readonly tickRate?: number;
+    readonly maxCatchUpTicks?: number;
+    readonly lifecycleTimeoutMs?: number;
+    readonly budgets?: Partial<RoomBudgets>;
+    readonly reconnect?: {
+        readonly graceMs: number;
+    };
+    readonly strategies?: Pick<RoomAuthoringStrategies, 'reconnectPolicy'> | undefined;
+    readonly messages?: Readonly<Record<string, RoomChannel>>;
+    readonly onMessage?: (context: RoomLockstepMessageContext) => undefined;
+}
+
+declare interface RoomLockstepDescriptor<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> extends RoomLockstepDefinition<S, I, O> {
+    readonly _tag: 'RoomDescriptor';
+    /** Lockstep rooms never join a World; declared so mixed descriptor reads narrow on it. */
+    readonly world?: undefined;
+    readonly auth: 'subject';
+    readonly state: S;
+    readonly input: I;
+    readonly options: O;
+    readonly guards: DeclaredAccess;
+    readonly tickRate: number;
+    readonly maxCatchUpTicks: number;
+    readonly lifecycleTimeoutMs: number;
+    readonly maxClients: number;
+    readonly budgets: RoomBudgets;
+    readonly reconnect: {
+        readonly graceMs: number;
+    };
+    readonly messages: Readonly<Record<string, RoomChannel>>;
+    readonly lockstep: RoomLockstepOptions<I> & {
+        readonly inputSchema: I;
+        readonly inputDelayTicks: number;
+        readonly rollbackHorizonTicks: number;
+        readonly inputPrediction: LockstepInputPrediction<(I)["Type"]>;
+        readonly maxPlayers: number;
+    };
+    /** State-sync lifecycle/spectators are never manufactured for a lockstep declaration. */
+    readonly initialState?: never;
+    readonly spectator?: never | undefined;
+}
+
+export declare interface RoomLockstepDesync {
+    readonly tick: number;
+    readonly playerId: number;
+    readonly expected: Uint64Words;
+    readonly received: Uint64Words;
+}
+
+export declare type RoomLockstepHashResult<S, I = unknown> = {
+    readonly _tag: 'pending' | 'duplicate' | 'expired' | 'match';
+    readonly tick: number;
+    readonly playerId: number;
+} | {
+    readonly _tag: 'desync';
+    readonly incident: RoomLockstepDesync;
+    readonly action: 'end' | 'flag';
+} | {
+    readonly _tag: 'desync';
+    readonly incident: RoomLockstepDesync;
+    readonly action: 'resync';
+    readonly snapshot: SimulationSnapshot<S>;
+    readonly inputs: ReadonlyArray<SimulationPlayerInput<I>>;
+    readonly continuation: ReadonlyArray<SimulationTickInputs<I>>;
+};
+
+export declare type RoomLockstepHostDelivery<I> = Extract<RoomLockstepServerAdvance<I>, {
+    readonly _tag: 'relayed';
+}> | Extract<LockstepStallDecision, {
+    readonly _tag: 'action';
+}>;
+
+/** Actual existing RoomHost HostedRoom consumer. Explicit owner drives one pure
+ * role and retains delivery records for outside-tick transfer. This is no normal
+ * SQL/Session Room-mode factory, native send, timer or borrowed-session disposer. */
+export declare class RoomLockstepHostLoop<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> implements HostedRoom {
+    #private;
+    readonly id: string;
+    constructor(simulation: Simulation<S, I, O>, seed: number, options: (O)["Type"], scope: RoomLockstepRosterScope, now: () => number, serverOptions?: RoomLockstepServerOptions, offered?: RoomLockstepHostLoopOptions);
+    private outside;
+    private operation;
+    private live;
+    private clock;
+    admit(playerId: number, actualSession: unknown): RoomLockstepRosterPlayer;
+    rebind(actualSession: unknown): RoomLockstepRosterPlayer;
+    seal(): readonly RoomLockstepRosterPlayer[];
+    admitAt(player: RoomLockstepRosterPlayer, actualSession: unknown): RoomLockstepRosterPlayer;
+    /** Late join after Start; the caller has journaled the join for `fromTick`. */
+    join(player: RoomLockstepRosterPlayer, actualSession: unknown, fromTick: number): RoomLockstepRosterPlayer;
+    /** Tick of the last complete matrix (the confirmed input frontier). */
+    get inputTick(): number;
+    /** Trusted pre-delivery rebuild over the same genuine sealed Sessions. Input
+     * authority and referee lag use existing role paths, never a state snapshot. */
+    replayMatrix(tick: number, sessions: ReadonlyArray<unknown>, payloads: ReadonlyArray<Uint8Array>): void;
+    finishBootstrap(): void;
+    submit(actualSession: unknown, firstTick: number, payloads: ReadonlyArray<Uint8Array>): RoomLockstepInputSubmission;
+    submitHash(actualSession: unknown, tick: number, hash: Uint64Words): RoomLockstepHashResult<S["Type"], I["Type"]>;
+    comparePendingHashes(maxClaims?: number): readonly RoomLockstepHashResult<S["Type"], I["Type"]>[];
+    recovery(): SimulationRecovery<S["Type"], I["Type"]>;
+    get serverRole(): RoomLockstepServerRole;
+    advance(): number;
+    drainDeliveries(): ReadonlyArray<RoomLockstepHostDelivery<(I)["Type"]>>;
+    /** Outside-tick preparation may fail; retain the exact record until accepted. */
+    nextDelivery(): RoomLockstepHostDelivery<(I)["Type"]> | null;
+    consumeDelivery(expected: RoomLockstepHostDelivery<(I)["Type"]>): void;
+    /** Only after the real supervisor takes this faulted owner and resolves its
+     * delivery/author failure. No new actor or replayed SQL side effect. */
+    retryFault(): void;
+    drainOutbox(): ReadonlyArray<RoomOutboxCommand>;
+    metrics(): RoomActorMetrics;
+    roleMetrics(): Readonly<{
+        observedTicks: number;
+        faulted: boolean;
+        pendingDeliveries: number;
+        pendingInputRecordBytes: number;
+        role: RoomLockstepServerRole;
+        tick: number;
+        refereeTick: number | null;
+        withdrawn: boolean;
+        refereeLagTicks: number;
+        stallAfterTicks: number;
+        stallAction: "pause" | "drop-player";
+        players: number;
+        pendingInputs: number;
+        pendingInputBytes: number;
+        queuedInputs: number;
+        queuedTicks: number;
+        queuedInputBytes: number;
+        pendingHashes: number;
+        retainedReplayTicks: number;
+        retainedReplayInputBytes: number;
+        comparedHashes: number;
+        desyncs: number;
+    }>;
+    exportSubject(tenantId: string, subjectId: string): RoomLockstepSubjectExport<I["Type"]>;
+    eraseSubject(tenantId: string, subjectId: string): number;
+    dispose(): void;
+    isDisposed(): boolean;
+}
+
+export declare interface RoomLockstepHostLoopOptions {
+    readonly tickRate?: number;
+    readonly maxCatchUpTicks?: number;
+    readonly maxPendingDeliveries?: number;
+    readonly maxPendingInputRecordBytes?: number;
+}
+
+declare interface RoomLockstepInitialPlayerContext extends RoomLockstepInitialRosterContext {
+    /** Server-private current admitted identity, never projected to the roster wire. */
+    readonly subjectId: string;
+    readonly sessionId: string;
+}
+
+declare interface RoomLockstepInitialRosterContext extends RoomLockstepRosterScope {
+    readonly maxPlayers: number;
+    readonly players: ReadonlyArray<RoomLockstepRosterPlayer>;
+}
+
+declare interface RoomLockstepInitialStrategies {
+    readonly playerId: (context: RoomLockstepInitialPlayerContext) => number;
+    readonly start: (context: RoomLockstepInitialRosterContext) => boolean;
+}
+
+declare interface RoomLockstepInputMatrix {
+    readonly players: RoomLockstepPlayerMask;
+    readonly inputs: ReadonlyArray<Uint8Array>;
+}
+
+/** Server-only actor-memory input roster. Actual normal Seat/SQL/Welcome session
+ * ownership is borrowed and rechecked; no new reservation or structural identity.
+ * Host invokes this after its real connection/frame budgets. No transport listener,
+ * store/read/write, timer, worker, signing material or default boot is acquired. */
+export declare class RoomLockstepInputRoster<I extends Schema.Codec<unknown, unknown>> {
+    #private;
+    constructor(schema: I, scope: RoomLockstepRosterScope, options?: RoomLockstepRosterOptions);
+    get tick(): number;
+    get sealed(): boolean;
+    metrics(): {
+        readonly pendingInputs: number;
+        readonly pendingBytes: number;
+        readonly players: number;
+    };
+    private work;
+    admit(playerId: number, session: unknown): RoomLockstepRosterPlayer;
+    /** Trusted server rebuild can retain a SQL-selected sparse slot; actual Session
+     * scope/layout/uniqueness remain the same admission contract. */
+    admitAt(player: RoomLockstepRosterPlayer, session: unknown): RoomLockstepRosterPlayer;
+    /** Same-owner reconnect replaces a withdrawn genuine admission only. The
+     * stable player/slot and all already accepted pending input bytes survive. */
+    rebind(actualSession: unknown): RoomLockstepRosterPlayer;
+    seal(): ReadonlyArray<RoomLockstepRosterPlayer>;
+    /** Late join after seal: the player's input is part of every matrix from `fromTick`, which
+     * must lie ahead of the consumed frontier so no delivered matrix changes. */
+    join(player: RoomLockstepRosterPlayer, session: unknown, fromTick: number): RoomLockstepRosterPlayer;
+    /** Slots whose input a tick's matrix carries, in slot order (the wire matrix order). */
+    private activeAt;
+    submit(session: unknown, firstTick: number, payloads: ReadonlyArray<Uint8Array>): RoomLockstepInputSubmission;
+    next(): RoomLockstepTickInputs<(I)["Type"]>;
+    consumeNext(): RoomLockstepTickInputs<(I)["Type"]>;
+    eraseSubject(tenantId: string, subjectId: string): number;
+    exportSubject(tenantId: string, subjectId: string): ReadonlyArray<{
+        readonly tick: number;
+        readonly playerId: number;
+        readonly input: (I)["Type"];
+    }>;
+    /** Current actual Session-to-player lookup; no client-selected identity. */
+    playerForSession(session: unknown): RoomLockstepRosterPlayer;
+    playersForSubject(tenantId: string, subjectId: string): ReadonlyArray<RoomLockstepRosterPlayer>;
+    /** Actor-memory withdrawal only. Borrowed sessions remain caller-owned. */
+    withdraw(): void;
+    private privacyScope;
+    private current;
+    private admitOwned;
+    private sealOwned;
+    /** Caller passes its actual constructed Session, never a client-chosen slot. */
+    private submitOwned;
+    private nextOwned;
+    /** Consume only a complete current matrix. Referee/snapshot/replay ownership
+     * must stage its own successful step before calling; no durable ACK here. */
+    private consumeNextOwned;
+    private removeSlot;
+    /** Outside-tick privacy seam; actual Rooms erase orchestration must call it. */
+    private eraseSubjectOwned;
+    private exportSubjectOwned;
+}
+
+export declare interface RoomLockstepInputSubmission {
+    readonly accepted: number;
+    readonly duplicates: number;
+    readonly expired: number;
+}
+
+export declare interface RoomLockstepJournal {
+    /** 1: Start roster only. 2: adds `joins`; every tick's matrix covers the roster at that tick. */
+    readonly version: 1 | 2;
+    readonly roomId: string;
+    readonly tenantId: string;
+    readonly ownerEpoch: number;
+    readonly hostId: string;
+    readonly initial: {
+        readonly requestId: string;
+        readonly seed: number;
+        readonly options: string;
+        readonly stateSchemaHash: number;
+        readonly inputSchemaHash: number;
+        readonly players: ReadonlyArray<{
+            readonly slot: number;
+            readonly playerId: number;
+            readonly subjectId: string;
+            readonly sessionId: string;
+        }>;
+    };
+    readonly adoption: {
+        readonly requestId: string;
+        readonly priorEpoch: number;
+    } | null;
+    readonly ticks: ReadonlyArray<{
+        readonly tick: number;
+        readonly requestId: string;
+        readonly inputs: ReadonlyArray<string>;
+    }>;
+    readonly joins?: ReadonlyArray<RoomLockstepJournalJoin>;
+    readonly digest: string;
+}
+
+export declare interface RoomLockstepJournalAppend extends RoomLockstepRosterScope {
+    readonly requestId: string;
+    readonly tick: number;
+    readonly inputs: ReadonlyArray<Uint8Array>;
+}
+
+/** A player admitted after Start (late join), effective from `tick`. Version 2 journals only. */
+declare interface RoomLockstepJournalJoin {
+    readonly tick: number;
+    readonly requestId: string;
+    readonly slot: number;
+    readonly playerId: number;
+    readonly subjectId: string;
+    readonly sessionId: string;
+}
+
+/** Admit a player after Start, effective from `tick` (ahead of every committed matrix). */
+declare interface RoomLockstepJournalJoinInput extends RoomLockstepRosterScope {
+    readonly requestId: string;
+    readonly tick: number;
+    readonly player: RoomLockstepJournalPlayer;
+}
+
+export declare const roomLockstepJournalLayer: <S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(store: DataStore, simulation: Simulation<S, I, O>, options: RoomLockstepJournalStoreOptions) => Layer.Layer<RoomLockstepJournalPort>;
+
+declare interface RoomLockstepJournalPlayer {
+    readonly slot: number;
+    readonly playerId: number;
+    readonly actualSession: unknown;
+}
+
+/** Trusted server capability, not a player RPC or inspection authority. */
+export declare class RoomLockstepJournalPort extends RoomLockstepJournalPort_base {
+}
+
+declare const RoomLockstepJournalPort_base: Context.ServiceClass<RoomLockstepJournalPort, "@voltro/RoomLockstepJournalPort", {
+    initialize(input: RoomLockstepJournalStart): Effect.Effect<RoomLockstepJournal, ProtocolError>;
+    append(input: RoomLockstepJournalAppend): Effect.Effect<RoomLockstepJournal, ProtocolError>;
+    /** Late join (version-2 journal). Optional: a journal without it refuses late players. */
+    readonly join?: (input: RoomLockstepJournalJoinInput) => Effect.Effect<RoomLockstepJournal, ProtocolError>;
+    load(scope: RoomLockstepRosterScope): Effect.Effect<RoomLockstepJournal | null, ProtocolError>;
+    adopt(scope: RoomLockstepRosterScope, priorEpoch: number, requestId: string): Effect.Effect<RoomLockstepJournal, ProtocolError>;
+    exportSubject(scope: RoomLockstepRosterScope, subjectId: string): Effect.Effect<RoomLockstepJournalSubjectExport, ProtocolError>;
+    erase(scope: RoomLockstepRosterScope, requestId: string): Effect.Effect<void, ProtocolError>;
+}>;
+
+export declare interface RoomLockstepJournalRebuild<S, O> {
+    readonly scope: RoomLockstepRosterScope;
+    readonly seed: number;
+    readonly options: O;
+    readonly players: ReadonlyArray<{
+        readonly slot: number;
+        readonly playerId: number;
+        readonly subjectId: string;
+        readonly sessionId: string;
+    }>;
+    readonly journalDigest: string;
+    readonly replayedTicks: number;
+    readonly inputBytes: number;
+    readonly snapshot: SimulationSnapshot<S>;
+}
+
+export declare interface RoomLockstepJournalRebuildOptions {
+    readonly hostId: string;
+    readonly maxTicks?: number;
+    readonly maxJournalBytes?: number;
+    readonly maxInputBytes?: number;
+    readonly maxPlayers?: number;
+    readonly maxRejectionAttempts?: number;
+}
+
+export declare interface RoomLockstepJournalStart extends RoomLockstepRosterScope {
+    readonly requestId: string;
+    readonly seed: number;
+    readonly options: unknown;
+    readonly players: ReadonlyArray<RoomLockstepJournalPlayer>;
+}
+
+export declare interface RoomLockstepJournalStoreOptions {
+    readonly hostId: string;
+    readonly epochNow: () => number;
+    readonly authorize: (scope: RoomLockstepRosterScope, operation: 'initialize' | 'append' | 'join' | 'load' | 'adopt' | 'export' | 'erase', subjectId?: string) => Effect.Effect<void, unknown>;
+    readonly erasure: Context.Service.Shape<typeof RoomErasurePort>;
+    readonly maxTicks?: number;
+    readonly maxJournalBytes?: number;
+    readonly maxPlayers?: number;
+}
+
+export declare interface RoomLockstepJournalSubjectExport {
+    readonly roomId: string;
+    readonly inputs: ReadonlyArray<{
+        readonly tick: number;
+        readonly playerId: number;
+        readonly input: unknown;
+    }>;
+}
+
+export declare interface RoomLockstepMemberIdentity {
+    readonly sessionId: string;
+    readonly subjectId: string;
+    readonly tenantId: string;
+}
+
+export declare interface RoomLockstepMemberOptions {
+    readonly name: string;
+    readonly maxClients?: number;
+    readonly budgets?: Partial<RoomBudgets>;
+    readonly messages?: Readonly<Record<string, RoomChannel>>;
+    /** Admit new Sessions after the roster is sealed (the Room declares late join). */
+    readonly lateJoin?: boolean;
+}
+
+/** Real Session membership without simulation state/init/step or actor lifecycle.
+ * Seat verification/consume/disconnect remain the existing Session's SQL work. */
+export declare class RoomLockstepMemberOwner<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> {
+    #private;
+    readonly id: string;
+    readonly tenantId: string;
+    readonly epoch: number;
+    readonly descriptor: {
+        readonly name: string;
+        readonly state: S;
+        readonly input: I;
+        readonly auth: 'subject';
+        readonly budgets: RoomBudgets;
+        readonly maxClients: number;
+        readonly messages: Readonly<Record<string, RoomChannel>>;
+    };
+    constructor(simulation: Simulation<S, I, O>, scope: RoomLockstepRosterScope, offered: RoomLockstepMemberOptions);
+    isDisposed(): boolean;
+    isFaulted(): boolean;
+    isRetiring(): boolean;
+    private live;
+    joinReservedAsync(offered: RoomClient, consumed: RoomConsumedSeat, signal?: AbortSignal): Promise<void>;
+    leaveAsync(sessionId: string, _reason?: RoomLeaveReason): Promise<void>;
+    /** First activation captures the genuine complete roster. Later activation can
+     * restore only the same retained Seat/Subject, never extend a sealed game. */
+    seal(): void;
+    isCurrent(sessionId: string, subjectId: string | null): boolean;
+    roster(): ReadonlyArray<RoomLockstepMemberIdentity>;
+    exportSubject(tenantId: string, subjectId: string): ReadonlyArray<RoomLockstepMemberIdentity>;
+    eraseSubject(tenantId: string, subjectId: string): number;
+    /** Pure immediate admission withdrawal; containing host joins native resources. */
+    withdraw(): void;
+    disposeAsync(): Promise<void>;
+}
+
+declare interface RoomLockstepMessageContext {
+    readonly roomId: string;
+    readonly tenantId: string;
+    readonly epoch: number;
+    readonly client: {
+        readonly sessionId: string;
+        readonly subjectId: string;
+        readonly tenantId: string;
+    };
+    readonly channel: string;
+    readonly payload: unknown;
+    /** Stage an ephemeral reply to the same current native Session. */
+    reply(channel: string, payload: unknown): void;
+    /** Stage an ephemeral message to the currently activated player Sessions. */
+    broadcast(channel: string, payload: unknown): void;
+}
+
+declare interface RoomLockstepOptions<I extends Schema.Codec<unknown, unknown>> extends RoomLockstepServerOptions {
+    readonly inputSchema?: I;
+    readonly inputDelayTicks?: number;
+    readonly rollbackHorizonTicks?: number;
+    readonly inputPrediction?: LockstepInputPrediction<(I)["Type"]>;
+    /** Admit players after Start (late join). Each joins at a tick chosen by the Host, ahead of
+     * the confirmed frontier by the input delay; every simulation sees it at that tick. */
+    readonly lateJoin?: boolean;
+}
+
+/** Declared lockstep composition over real pre-seat metadata and genuine Sessions.
+ * Implements the existing HostedRoom seam. SQL, encoding and native work occur
+ * only in create/start/flush/close supervision, never in advance. */
+export declare class RoomLockstepOwnedRoom<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> implements HostedRoom {
+    #private;
+    readonly id: string;
+    readonly tenantId: string;
+    readonly hostId: string;
+    readonly epoch: number;
+    readonly descriptor: RoomLockstepDescriptor<S, I, O>;
+    private constructor();
+    static create<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(offeredDescriptor: RoomLockstepDescriptor<S, I, O>, offered: RoomLockstepCreation, provided: RoomLockstepOwnedRoomDependencies): Promise<RoomLockstepOwnedRoom<S, I, O>>;
+    /** Install only the actual retained successor metadata. Native admission and
+     * publication remain fenced until real roster/input bootstrap is bound. */
+    static restore<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(offeredDescriptor: RoomLockstepDescriptor<S, I, O>, offeredScope: RoomLockstepRosterScope, offeredTruth: RoomLockstepRecoveryTruth, provided: RoomLockstepOwnedRoomDependencies): Promise<RoomLockstepOwnedRoom<S, I, O>>;
+    private static build;
+    /** Called only after successful installation in the containing Host/Runtime. SQL
+     * publication and its exact current receipt are required before native transfer. */
+    publishAsync(): Promise<void>;
+    /** Server-private staged truth grants no wire/native input admission. */
+    recoveryTruth(): RoomLockstepRecoveryTruth | null;
+    rosterOpen(): boolean;
+    isPublished(): boolean;
+    private outside;
+    private live;
+    private admitWork;
+    /** On success this owner takes the actual Session/native close lifetime. */
+    connect(transport: RoomTransport): RoomServerSession<S, I, O>;
+    /** Server chooses opaque player IDs only for current genuine owned Sessions. */
+    admit(playerId: number, actualSession: RoomServerSession<S, I, O>): RoomLockstepRosterPlayer;
+    roster(): ReadonlyArray<RoomLockstepRosterPlayer>;
+    /** Normal supervision: only actual current Welcomed owned Sessions can be bound.
+     * A retained durable Start attempt retries exactly without rerunning strategies. */
+    prepareInitialRoster(offered?: Partial<RoomLockstepInitialStrategies>): Promise<ReadonlyArray<RoomLockstepRosterPlayer>>;
+    startAsync(): Promise<ReadonlyArray<RoomLockstepRosterPlayer>>;
+    private startAccepted;
+    advance(): number;
+    private messageTargets;
+    private captureMessage;
+    private admitMessages;
+    /** Non-authoritative app supervision, never simulation input or SQL truth. */
+    broadcast(channel: string, payload: unknown): void;
+    private receiveMessage;
+    private flushMessages;
+    messageMetrics(): {
+        readonly pendingCommands: number;
+        readonly pendingBytes: number;
+    };
+    flush(): Promise<{
+        readonly writes: number;
+        readonly pending: boolean;
+    }>;
+    private flushAccepted;
+    private releaseSession;
+    /** Outside-tick cleanup; a failed close retains the exact owned Session. */
+    maintenance(): Promise<void>;
+    metrics(): Readonly<{
+        clients: number;
+        tick: number;
+        droppedTicks: number;
+        queuedInputs: number;
+        outboxCommands: number;
+        extensionDurationMs: Readonly<Record<string, number>>;
+        extensionOverruns: Readonly<Record<string, number>>;
+    }>;
+    /** One bounded flush pass per attempt. Retain exact native/journal retries;
+     * never advance simulation or invent a state-sync checkpoint for Lockstep. */
+    prepareDrain(): Promise<RoomDrainHandoff>;
+    transportMetrics(): Readonly<{
+        started: boolean;
+        disposed: boolean;
+        pendingWireBytes: number;
+        pendingTargets: number;
+        redundancyTicks: number;
+        redundancyWireBytes: number;
+        pendingHashResults: number;
+        pendingHashSources: number;
+        reconnecting: boolean;
+        joining: boolean;
+        queuedFrames: number;
+        flushing: boolean;
+        journaled: boolean;
+        journalTick: number;
+        initializing: boolean;
+        observedTicks: number;
+        faulted: boolean;
+        pendingDeliveries: number;
+        pendingInputRecordBytes: number;
+        role: RoomLockstepServerRole;
+        tick: number;
+        refereeTick: number | null;
+        withdrawn: boolean;
+        refereeLagTicks: number;
+        stallAfterTicks: number;
+        stallAction: "pause" | "drop-player";
+        players: number;
+        pendingInputs: number;
+        pendingInputBytes: number;
+        queuedInputs: number;
+        queuedTicks: number;
+        queuedInputBytes: number;
+        pendingHashes: number;
+        retainedReplayTicks: number;
+        retainedReplayInputBytes: number;
+        comparedHashes: number;
+        desyncs: number;
+    }>;
+    drainOutbox(): readonly RoomOutboxCommand[];
+    isDisposed(): boolean;
+    dispose(): void;
+    /** revoked=true is trusted supervision after real SQL fencing. SQL/native
+     * failures remain failures; borrowed SQL services/resources are never closed. */
+    disposeAsync(revoked?: boolean): Promise<void>;
+}
+
+export declare interface RoomLockstepOwnedRoomDependencies {
+    /** Host scheduling policy only; does not change simulation or journal identity. */
+    readonly maxCatchUpTicks?: number;
+    readonly hostId: string;
+    readonly admission: Context.Service.Shape<typeof RoomLockstepAdmissionPort>;
+    readonly journal: Context.Service.Shape<typeof RoomLockstepJournalPort>;
+    readonly runEffect: RoomSnapshotEffectRunner;
+    readonly clock: RoomClock;
+    readonly seats: RoomSeatAdmission;
+    readonly sessionOptions: Omit<RoomServerSessionOptions, 'epoch' | 'onClientMessage' | 'spectatorHistory'>;
+    readonly transport?: Omit<RoomLockstepTransportOptions, 'journal'> | undefined;
+}
+
+/** Bits identify server-assigned roster slots 0..63, not Subject or player IDs. */
+declare type RoomLockstepPlayerMask = Uint64Words;
+
+declare interface RoomLockstepRecoveryTruth {
+    readonly admission: RoomLockstepAdmission;
+    readonly journal: RoomLockstepJournal | null;
+    readonly options: unknown;
+}
+
+export declare interface RoomLockstepReplay<S, I, O> {
+    readonly seed: number;
+    readonly options: O;
+    readonly base: SimulationSnapshot<S>;
+    readonly inputs: ReadonlyArray<{
+        readonly tick: number;
+        readonly inputs: ReadonlyArray<SimulationPlayerInput<I>>;
+        readonly hash: Uint64Words;
+    }>;
+    /** The matrix used at the base tick (absent at tick 0), so a `join` hook replays exactly. */
+    readonly baseInputs?: ReadonlyArray<SimulationPlayerInput<I>>;
+}
+
+export declare interface RoomLockstepRosterOptions {
+    readonly initialTick?: number;
+    readonly maxPlayers?: number;
+    readonly maxFutureTicks?: number;
+    readonly maxBatchInputs?: number;
+    readonly maxPendingInputs?: number;
+    readonly maxPendingBytes?: number | undefined;
+}
+
+export declare interface RoomLockstepRosterPlayer {
+    readonly slot: number;
+    readonly playerId: number;
+}
+
+export declare interface RoomLockstepRosterScope {
+    readonly roomId: string;
+    readonly tenantId: string;
+    readonly epoch: number;
+}
+
+/** Explicit CPU-only server role owner over genuine current Seat/Welcome input
+ * admission. Host drives advance and delayed pump. No scheduler, listener,
+ * SQL/HotStore command, sanction write or Room-mode/default boot installation. */
+export declare class RoomLockstepServer<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> {
+    #private;
+    constructor(simulation: Simulation<S, I, O>, seed: number, options: (O)["Type"], scope: RoomLockstepRosterScope, offered?: RoomLockstepServerOptions);
+    get role(): RoomLockstepServerRole;
+    get tick(): number;
+    get refereeTick(): number | null;
+    get withdrawn(): boolean;
+    private work;
+    admit(playerId: number, actualSession: unknown): RoomLockstepRosterPlayer;
+    admitAt(player: RoomLockstepRosterPlayer, actualSession: unknown): RoomLockstepRosterPlayer;
+    rebind(actualSession: unknown): RoomLockstepRosterPlayer;
+    seal(): ReadonlyArray<RoomLockstepRosterPlayer>;
+    /** Late join: the referee sees the player's input from `fromTick` on. */
+    join(player: RoomLockstepRosterPlayer, actualSession: unknown, fromTick: number): RoomLockstepRosterPlayer;
+    playerForSession(actualSession: unknown): RoomLockstepRosterPlayer;
+    submit(actualSession: unknown, firstTick: number, payloads: ReadonlyArray<Uint8Array>): RoomLockstepInputSubmission;
+    private copyInputs;
+    /** Input authority is independent of referee execution. Prepare all authored
+     * captures/encoding/budgets before consuming a genuine complete matrix. */
+    advance(maxInputRecordBytes?: number): RoomLockstepServerAdvance<(I)["Type"]>;
+    /** Bounded delayed referee work; each successful tick commits separately.
+     * Failed step retains that exact queued tick and original RNG for retry. */
+    pumpReferee(maxSteps?: number): {
+        readonly steps: number;
+        readonly tick: number;
+    };
+    /** Host supplies its actual monotonically observed logical tick, not a
+     * client timestamp or wall clock. Repeated polls do not increase stall age. */
+    observeStall(observationTick: number): LockstepStallDecision | {
+        readonly _tag: 'ready' | 'empty';
+        readonly tick: number;
+    };
+    snapshot(): SimulationSnapshot<(S)["Type"]>;
+    /** Actual current referee state and contiguous authority, also used by desync.
+     * No client hash claim is manufactured for ordinary bootstrap. */
+    recovery(): SimulationRecovery<(S)["Type"], (I)["Type"]>;
+    private recoveryOwned;
+    private incident;
+    private currentPlayer;
+    submitHash(actualSession: unknown, tick: number, offered: Uint64Words): RoomLockstepHashResult<(S)["Type"], (I)["Type"]>;
+    /** Separate bounded comparison pass. Incident publication/sanction writes and
+     * resync encoding/delivery belong outside this CPU-only owner. */
+    comparePendingHashes(maxClaims?: number): ReadonlyArray<RoomLockstepHashResult<(S)["Type"], (I)["Type"]>>;
+    replay(): RoomLockstepReplay<(S)["Type"], (I)["Type"], (O)["Type"]>;
+    private copySnapshot;
+    exportSubject(tenantId: string, subjectId: string): RoomLockstepSubjectExport<(I)["Type"]>;
+    /** Shared state cannot be safely scrubbed by deleting one field. If this
+     * subject participates, withdraw and release every private simulation/replay/
+     * pending claim/input reference. Real host must join workers/transport/SQL. */
+    eraseSubject(tenantId: string, subjectId: string): number;
+    withdraw(): void;
+    private withdrawOwned;
+    metrics(): Readonly<{
+        role: RoomLockstepServerRole;
+        tick: number;
+        refereeTick: number | null;
+        withdrawn: boolean;
+        refereeLagTicks: number;
+        stallAfterTicks: number;
+        stallAction: "pause" | "drop-player";
+        players: number;
+        pendingInputs: number;
+        pendingInputBytes: number;
+        queuedInputs: number;
+        queuedTicks: number;
+        queuedInputBytes: number;
+        pendingHashes: number;
+        retainedReplayTicks: number;
+        retainedReplayInputBytes: number;
+        comparedHashes: number;
+        desyncs: number;
+    }>;
+}
+
+export declare type RoomLockstepServerAdvance<I> = {
+    readonly _tag: 'relayed';
+    readonly tick: number;
+    readonly inputRecordBytes: number;
+    readonly players: RoomLockstepPlayerMask;
+    readonly inputs: ReadonlyArray<SimulationPlayerInput<I>>;
+} | {
+    readonly _tag: 'waiting';
+    readonly tick: number;
+    readonly waitingFor: RoomLockstepPlayerMask;
+} | {
+    readonly _tag: 'empty';
+    readonly tick: number;
+};
+
+export declare interface RoomLockstepServerOptions extends Omit<RoomLockstepRosterOptions, 'initialTick'> {
+    readonly strategies?: LockstepPolicyStrategies | undefined;
+    readonly stallPolicy?: LockstepStallPolicyOptions;
+    readonly serverRole?: RoomLockstepServerRole;
+    readonly refereeLagTicks?: number;
+    readonly hashEvery?: number;
+    readonly hashHistoryTicks?: number;
+    readonly maxQueuedTicks?: number;
+    readonly maxQueuedInputBytes?: number;
+    readonly maxPendingHashes?: number;
+    readonly maxRefereeSteps?: number;
+    readonly maxReplayTicks?: number;
+    readonly maxReplayInputBytes?: number;
+    readonly maxSnapshotBudgetBytes?: number;
+    readonly maxRejectionAttempts?: number;
+    readonly onDesync?: 'resync' | 'end' | 'flag' | ((incident: RoomLockstepDesync) => 'resync' | 'end' | 'flag');
+}
+
+export declare type RoomLockstepServerRole = 'relay' | 'referee' | 'full';
+
+export declare interface RoomLockstepSubjectExport<I> {
+    readonly inputs: ReadonlyArray<{
+        readonly tick: number;
+        readonly playerId: number;
+        readonly input: I;
+    }>;
+    readonly hashClaims: ReadonlyArray<{
+        readonly tick: number;
+        readonly playerId: number;
+        readonly hash: Uint64Words;
+    }>;
+}
+
+export declare interface RoomLockstepTerminal extends RoomLockstepRosterScope {
+    readonly disposition: 'faulted' | 'disposed';
+}
+
+export declare const roomLockstepTerminalLayer: <S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(store: DataStore, descriptor: RoomLockstepDescriptor<S, I, O>, options: RoomLockstepTerminalStoreOptions) => Layer.Layer<RoomLockstepTerminalPort, never, never>;
+
+/** Outside-tick lifecycle commit after actual Session/native withdrawal. Retains
+ * SQL creation and input truth; this is neither a checkpoint nor an erase. */
+export declare class RoomLockstepTerminalPort extends RoomLockstepTerminalPort_base {
+}
+
+declare const RoomLockstepTerminalPort_base: Context.ServiceClass<RoomLockstepTerminalPort, "@voltro/RoomLockstepTerminalPort", {
+    terminate(input: RoomLockstepTerminal): Effect.Effect<RoomLockstepTerminalReceipt, ProtocolError>;
+}>;
+
+export declare interface RoomLockstepTerminalReceipt extends RoomLockstepTerminal {
+    readonly hostId: string;
+}
+
+export declare interface RoomLockstepTerminalStoreOptions {
+    readonly hostId: string;
+    readonly epochNow: () => number;
+    readonly authorize: (input: RoomLockstepTerminal) => Effect.Effect<void, unknown>;
+}
+
+export declare type RoomLockstepTickInputs<I> = {
+    readonly _tag: 'complete';
+    readonly tick: number;
+    readonly players: RoomLockstepPlayerMask;
+    readonly inputs: ReadonlyArray<SimulationPlayerInput<I>>;
+} | {
+    readonly _tag: 'waiting';
+    readonly tick: number;
+    readonly waitingFor: RoomLockstepPlayerMask;
+} | {
+    readonly _tag: 'empty';
+    readonly tick: number;
+};
+
+export declare interface RoomLockstepTransportJournal {
+    readonly service: Context.Service.Shape<typeof RoomLockstepJournalPort>;
+    readonly runEffect: RoomSnapshotEffectRunner;
+    readonly startRequestId: string;
+}
+
+declare interface RoomLockstepTransportLimits {
+    readonly redundantTicks?: number;
+    readonly maxFlushWork?: number;
+    readonly maxPendingWireBytes?: number;
+    readonly maxRedundancyWireBytes?: number;
+    readonly maxPendingHashResults?: number;
+}
+
+export declare interface RoomLockstepTransportOptions extends RoomLockstepTransportLimits {
+    readonly journal?: RoomLockstepTransportJournal;
+}
+
+/** Explicit supervised bridge over genuine SQL/Seat/Welcome Sessions. Owns the
+ * actual HostedRoom loop; all encoding/writes happen in flush(), outside advance.
+ * Normal defineRoom/runtime mode selection and the lockstep client are separate. */
+export declare class RoomLockstepTransportOwner<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> implements HostedRoom {
+    #private;
+    readonly id: string;
+    constructor(simulation: Simulation<S, I, O>, seed: number, options: (O)["Type"], scope: RoomLockstepRosterScope, now: () => number, serverOptions?: RoomLockstepServerOptions, loopOptions?: RoomLockstepHostLoopOptions, offered?: RoomLockstepTransportOptions);
+    private live;
+    private operation;
+    private current;
+    private deliverable;
+    private frameBytes;
+    admit(playerId: number, actualSession: unknown): RoomLockstepRosterPlayer;
+    /** Actual canonical successor truth, staged before any native admission. */
+    stageRecovery(saved: RoomLockstepJournal): void;
+    admitRecovered(actualSession: unknown): RoomLockstepRosterPlayer;
+    /** Reconnect uses current SQL truth and a new actual Welcome. The running
+     * authority is retained; only its withdrawn Session capability is replaced. */
+    rebindAsync(actualSession: unknown): Promise<RoomLockstepRosterPlayer>;
+    private inputHistory;
+    /** Joins journaled ahead of the frontier: a bootstrapped Session learns them as LsJoin frames. */
+    private futureJoins;
+    /** One current producer for genuine same-owner and elected-successor Start.
+     * Actual authority/input state is read only in outside-tick supervision. */
+    private bootstrap;
+    /** Queues LsStart; the explicit outside-tick flush must complete its writes. */
+    start(): ReadonlyArray<RoomLockstepRosterPlayer>;
+    private queueStart;
+    /** Durable start retains the exact roster/request across unknown commit replies.
+     * No seal, simulation tick, binding or LsStart before a captured SQL receipt. */
+    startAsync(): Promise<ReadonlyArray<RoomLockstepRosterPlayer>>;
+    private startRecovered;
+    /** Whether a Session belongs to a retained player (reconnect) rather than a new one. */
+    retains(actualSession: unknown): boolean;
+    /** A late join can start now: durable frontier confirmed, nothing in flight, and a snapshot
+     * bootstrap (referee/full) does not straddle an earlier join. */
+    lateJoinReady(): boolean;
+    /** Late join: journal the player for `frontier + leadTicks`, then bootstrap it (Start at the
+     * frontier, earlier joins in its history or snapshot) and announce it to every Session before
+     * any matrix of that tick. Needs a fully confirmed durable frontier, like reconnect. */
+    joinAsync(actualSession: unknown, playerId: number, leadTicks: number): Promise<RoomLockstepRosterPlayer>;
+    private runJournal;
+    private receive;
+    advance(): number;
+    private prepareNext;
+    private commitPrepared;
+    /** Actual tracked reliable completions, one bounded pass. Retry retains exactly
+     * the failed target/frame; fulfilled targets are never resent by a retry. */
+    flush(): Promise<{
+        readonly writes: number;
+        readonly pending: boolean;
+    }>;
+    retryFault(): void;
+    drainOutbox(): ReadonlyArray<RoomOutboxCommand>;
+    metrics(): RoomActorMetrics;
+    /** Local retained durable frontier, only after accepted supervision drained.
+     * The containing owner must compare it with a fresh actual SQL load. */
+    journalBoundary(): {
+        readonly digest: string | null;
+        readonly tick: number;
+    };
+    transportMetrics(): Readonly<{
+        started: boolean;
+        disposed: boolean;
+        pendingWireBytes: number;
+        pendingTargets: number;
+        redundancyTicks: number;
+        redundancyWireBytes: number;
+        pendingHashResults: number;
+        pendingHashSources: number;
+        reconnecting: boolean;
+        joining: boolean;
+        queuedFrames: number;
+        flushing: boolean;
+        journaled: boolean;
+        journalTick: number;
+        initializing: boolean;
+        observedTicks: number;
+        faulted: boolean;
+        pendingDeliveries: number;
+        pendingInputRecordBytes: number;
+        role: RoomLockstepServerRole;
+        tick: number;
+        refereeTick: number | null;
+        withdrawn: boolean;
+        refereeLagTicks: number;
+        stallAfterTicks: number;
+        stallAction: "pause" | "drop-player";
+        players: number;
+        pendingInputs: number;
+        pendingInputBytes: number;
+        queuedInputs: number;
+        queuedTicks: number;
+        queuedInputBytes: number;
+        pendingHashes: number;
+        retainedReplayTicks: number;
+        retainedReplayInputBytes: number;
+        comparedHashes: number;
+        desyncs: number;
+    }>;
+    exportSubject(tenantId: string, subjectId: string): RoomLockstepSubjectExport<I["Type"]>;
+    eraseSubject(tenantId: string, subjectId: string): Promise<number>;
+    private release;
+    dispose(): void;
+    /** Joins this owner's real in-flight delivery. Borrowed Sessions/SQL/native
+     * transport close still belong to the containing host. Rejections stay red. */
+    disposeAsync(): Promise<void>;
+    isDisposed(): boolean;
+}
+
+/** Public opaque simulation identities, never Subjects or Session credentials. */
+declare interface RoomLockstepWirePlayer {
+    readonly slot: number;
+    readonly playerId: number;
+}
+
+declare interface RoomMemberContext<S, O> {
+    /** Prepared native CPU queries only, installed before actor lifecycle. */
+    readonly geometry?: GeometryWorldView | undefined;
+    readonly state: RoomState<S>;
+    readonly options: O;
+    readonly client: RoomClient;
+    readonly app: RoomAppBridge;
+    readonly clock: RoomClock;
+    readonly scheduler: RoomScheduler;
+    /** World Rooms, ordinary player join: the server-owned entity this Session controls and
+     * its last persisted `persistEntity` data. Build the state entity from it when absent. */
+    readonly world?: RoomWorldMember | undefined;
+}
+
+declare interface RoomOutboxCommand {
+    readonly requestId: string;
+    readonly kind: 'publish' | 'run';
+    readonly name: string;
+    readonly payload: unknown;
+    readonly key?: string;
+}
+
+declare interface RoomPoolRuntimeDefaults {
+    /** Maximum state-sync catch-up ticks per host turn; never changes simulation Hz. */
+    readonly maxCatchUpTicks: number;
+    readonly snapshotEveryMs: number;
+    readonly hibernate: boolean;
+}
+
+declare interface RoomReliableLane {
+    send(frame: Uint8Array): Promise<void>;
+    onFrame(listener: (frame: Uint8Array, receivedAt: number) => void): () => void;
+}
+
+declare interface RoomReplayLimits {
+    readonly maxBytes: number;
+    readonly maxFrameBytes: number;
+    readonly maxFrames: number;
+    readonly maxHighlights: number;
+    readonly maxSchemaBytes: number;
+    readonly maxDurationMs: number;
+    readonly checkpointEveryMs: number;
+}
+
+/** Browser-safe trusted server contract. No player mutation or storage adapter
+ * is imported at value level; replacement services use this exact Tag. */
+declare class RoomReplayPort extends RoomReplayPort_base {
+}
+
+declare const RoomReplayPort_base: Context.ServiceClass<RoomReplayPort, "@voltro/RoomReplayPort", {
+    publish(input: RoomReplayPublish): Effect.Effect<RoomStoredReplay, ProtocolError>;
+    load(scope: RoomReplayScope): Effect.Effect<Uint8Array, ProtocolError>;
+    erase(scope: RoomReplayScope, requestId: string): Effect.Effect<void, ProtocolError>;
+    expire(scope: RoomReplayScope, requestId: string): Effect.Effect<void, ProtocolError>;
+    subjectRooms(request: PluginPrivacyRequest): Effect.Effect<ReadonlyArray<string>, ProtocolError>;
+    eraseSubject(request: PluginPrivacyRequest): Effect.Effect<void, ProtocolError>;
+    exportSubject(request: PluginPrivacyRequest, roomId?: string): Effect.Effect<ReadonlyArray<RoomStoredReplay>, ProtocolError>;
+}>;
+
+declare type RoomReplayPublicationMetadata = Omit<RoomReplayPublish, 'bytes'>;
+
+declare interface RoomReplayPublish extends RoomReplayScope {
+    readonly roomId: string;
+    readonly roomName: string;
+    readonly matchId: string;
+    readonly participants: ReadonlyArray<string>;
+    readonly visibility: 'private' | 'unlisted' | 'public';
+    readonly expiresAtMs: number | null;
+    readonly bytes: Uint8Array;
+}
+
+declare interface RoomReplayRecordingBinding {
+    readonly port: Context.Service.Shape<typeof RoomReplayPort>;
+    readonly metadata: RoomReplayPublicationMetadata;
+    /** Actual app Effect runtime/ConfigProvider; never open another runtime. */
+    readonly runEffect: RoomSnapshotEffectRunner;
+    readonly limits?: Partial<RoomReplayLimits>;
+}
+
+declare interface RoomReplayScope {
+    readonly tenantId: string;
+    readonly replayId: string;
+}
+
+/** One host driver composes the actual actor and binary server session. There
+ * are no autonomous actor timers. Its caller owns cadence and shutdown; each
+ * turn is synchronous simulation followed by awaited checkpoint I/O. */
+export declare class RoomRuntime {
+    readonly capacity: number;
+    readonly clock: RoomClock;
+    private readonly checkpoints;
+    readonly host: RoomHost;
+    private readonly loopObservation;
+    private readonly rooms;
+    private readonly pending;
+    private readonly heldPublication;
+    private readonly terminal;
+    private readonly withdrawn;
+    private readonly drains;
+    private readonly migrationNotified;
+    private turning;
+    private closed;
+    private checkpointCommits;
+    private checkpointStateBytes;
+    private unchangedSnapshotsSkipped;
+    private readonly poolDefaults;
+    private readonly snapshotBudget;
+    private lastPeriodicRoom;
+    constructor(capacity: number, clock: RoomClock, checkpoints: Context.Service.Shape<typeof RoomCheckpointPort>, options?: RoomRuntimeSnapshotOptions);
+    create<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(id: string, tenantId: string, descriptor: RoomDescriptor<S, I, O>, options: unknown, epoch: number, admission: RoomSeatAdmission, sessionOptions: RoomRuntimeSessionOptions): RoomActor<S, I, O>;
+    add<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(id: string, tenantId: string, descriptor: RoomDescriptor<S, I, O>, state: (S)["Type"], options: (O)["Type"], recovery: RoomActorRecovery & {
+        readonly revision: number;
+        readonly publicationHeld?: boolean;
+        readonly worldRecoveryEpoch?: number | undefined;
+    }, admission: RoomSeatAdmission, sessionOptions: RoomRuntimeSessionOptions): RoomActor<S, I, O>;
+    activateWorldMembers(roomId: string, tenantId: string, epoch: number, binding: WorldTargetSeatBinding, authorize: () => Promise<void>): Promise<void>;
+    /** One actor draft and receipt replacement; caller persists the result. */
+    replaceWorldGhostProjection(roomId: string, tenantId: string, input: RoomWorldHookInput, previous: RoomWorldHookInput, maxBytes: number, authorize: () => Promise<void>): Promise<void>;
+    cancelWorldGhost(roomId: string, tenantId: string, input: RoomWorldHookInput, maxBytes: number, authorize: () => Promise<void>): Promise<void>;
+    cancelWorldPreview(roomId: string, tenantId: string, epoch: number, requestId: string, authorize: () => Promise<void>): Promise<void>;
+    previewWorldEnter(roomId: string, tenantId: string, input: RoomWorldHookInput, maxBytes: number, signal?: AbortSignal): Promise<void>;
+    /** Await bounded real authentication/lifecycle work before privileged Session
+     * withdrawal; an in-flight Hello must not escape by lacking a published id. */
+    settleSessions(roomId: string, tenantId: string, epoch: number): Promise<void>;
+    /** False while the actor runs lifecycle work (join, leave, World hooks); receipt reads wait. */
+    worldLifecycleQuiet(roomId: string): boolean;
+    worldReceiptSnapshot(roomId: string, tenantId: string, epoch: number): ReadonlyArray<RoomWorldReceipt>;
+    retireWorldReceipt(roomId: string, tenantId: string, epoch: number, requestId: string, operation: 'enter' | 'exit' | 'ghost'): Promise<void>;
+    /** Trusted lifecycle mutation only. Controller callers persist its state and
+     * receipt before acknowledging; this method alone grants no SQL ownership. */
+    hasWorldReceipt(roomId: string, tenantId: string, epoch: number, requestId: string, operation: 'enter' | 'exit' | 'ghost'): boolean;
+    applyWorldHook(roomId: string, tenantId: string, operation: 'enter' | 'exit' | 'ghost', input: RoomWorldHookInput, maxBytes: number, signal?: AbortSignal, authorizeCommit?: () => Promise<void>, replaceExitReceipt?: boolean, previousGhost?: RoomWorldHookInput, retainGhostProjection?: boolean, promoteGhosts?: ReadonlyArray<RoomWorldHookInput>): Promise<void>;
+    finalizeWorldExit(roomId: string, tenantId: string, input: RoomWorldExitInput, maxBytes: number, retain: (capture: {
+        readonly entity: unknown;
+        readonly data: unknown;
+    }) => Promise<void>, authorize: () => Promise<void>, expectedEntity?: unknown, signal?: AbortSignal): Promise<void>;
+    worldFinalizationAfterglow(roomId: string, tenantId: string, epoch: number): RoomWorldExitInput['afterglow'];
+    worldFinalizationRequest(roomId: string, tenantId: string, epoch: number): string | null;
+    notifyWorldHandoff(roomId: string, tenantId: string, input: Omit<RoomWorldHandoffFrame, 'tick'>, authorize: () => Promise<void>): Promise<void>;
+    completeWorldFinalization(roomId: string, tenantId: string, epoch: number, requestId: string, authorize: () => Promise<void>): Promise<void>;
+    reconcileWorldSource(roomId: string, tenantId: string, input: RoomWorldHookInput & {
+        readonly requestId: string;
+    }, maxBytes: number, authorize: () => Promise<void>, signal?: AbortSignal): Promise<void>;
+    /** Actual owned actor capture under the same exclusion as a host turn.
+     * This reads no replacement entity payload and grants no transition permission. */
+    configureWorldCellMovement(roomId: string, tenantId: string, epoch: number, bounds?: WorldBounds, marginUnits?: number): Promise<void>;
+    captureWorldMovement(roomId: string, tenantId: string, epoch: number): Promise<WorldMovementObservation>;
+    worldMovementSnapshot(roomId: string, tenantId: string, epoch: number): {
+        readonly bound: boolean;
+        readonly clamped: number;
+    };
+    listWorldEntityIds(roomId: string, tenantId: string, epoch: number, maximum: number, maxBytes: number): Promise<ReadonlyArray<string>>;
+    captureWorldProjection(roomId: string, tenantId: string, epoch: number, entityId: string, maxBytes: number): Promise<{
+        readonly entity: unknown;
+        readonly data: unknown;
+        readonly tick: number;
+    }>;
+    captureWorldEntity(roomId: string, tenantId: string, epoch: number, entityId: string, maxBytes: number): Promise<{
+        readonly entity: unknown;
+        readonly data: unknown;
+    }>;
+    /** Actual geometry resource only, before/after the CPU turn. No absent-room
+     * SQL acquisition; a synchronization failure retains publication for retry. */
+    synchronizeGeometry(roomId: string): Promise<void>;
+    /** Trusted outside-Tick drain. Holds the same exclusion as a Host turn,
+     * joins both accepted graphs and leaves the native CPU inventory readable.
+     * Failure retains fences and exact cleanup; no version/reopen is implied. */
+    quiesceGeometry(roomId: string): Promise<void>;
+    /** Trusted confirmed CPU version activation +fresh original graphs. Actual
+     * migration/lease preparation happens outside the Tick. A failed activation
+     * retains its exact token and closed admission; retry cannot roll SQL back. */
+    activateGeometryVersion(roomId: string, token: GeometryVersionActivation): Promise<void>;
+    /** Same-version administrative change uses the actual Host exclusion and
+     * original graph readmission. SQL/lease preparation remains outside Tick. */
+    activateGeometryChange(roomId: string, token: GeometryActivation): Promise<void>;
+    /** Explicit installed mode in the same Host/map/session lookup and turn. The
+     * factory has already committed real pre-seat SQL metadata; no state checkpoint. */
+    addLockstep<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(owner: RoomLockstepOwnedRoom<S, I, O>, offered: RoomRuntimeLockstepBinding): void;
+    publishLockstep(roomId: string): Promise<void>;
+    lockstepRosterOpen(roomId: string): boolean;
+    admitLockstep(roomId: string, playerId: number, actualSession: RoomServerSessionHandle): RoomLockstepRosterPlayer;
+    prepareLockstepInitialRoster(roomId: string, strategies?: Partial< RoomLockstepInitialStrategies>): Promise<ReadonlyArray<RoomLockstepRosterPlayer>>;
+    startLockstep(roomId: string): Promise<ReadonlyArray<RoomLockstepRosterPlayer>>;
+    private assertAdmission;
+    /** Initial state is persisted before a staged SQL room becomes discoverable.
+     * This is supervision, never a simulated tick. Retained failures are retryable. */
+    holdPublication(roomId: string): void;
+    isPublicationHeld(roomId: string): boolean;
+    publishHeld(roomId: string, complete?: () => Promise<void>): Promise<void>;
+    persist(roomId: string): Promise<void>;
+    private persistRoom;
+    connect(roomId: string, transport: RoomTransport): RoomServerSessionHandle;
+    /** Synchronous host-private identity lookup. A turn awaiting checkpoint I/O
+     * does not withdraw an already welcomed Session. This reads no actor state,
+     * SQL or registry and grants no durable lease; all lifecycle fences still apply. */
+    readSessionAdmission(roomId: string, sessionId: string): RoomSessionAdmissionEvidence | null;
+    /** Ownership is checked by the controller before asking for socket teardown.
+     * A cancelled admission that has not consumed the seat will fail its SQL CAS. */
+    leaveSession(roomId: string, sessionId: string): Promise<void>;
+    /** Host operator kick of every admitted session of one subject. The controller
+     * checks ownership first; a `kicked` close releases each seat (no reconnect grace). */
+    kickSubject(roomId: string, tenantId: string, subjectId: string | null, reason: string): Promise<number>;
+    /** Trusted controller supplies the exact revoked tuple after SQL observation.
+     * Only local resources are removed: no checkpoint/seat/command write or ACK.
+     * Pending old-epoch payloads remain retained until cleanup actually completes. */
+    withdrawOwnership(roomId: string, tenantId: string, epoch: number): Promise<void>;
+    /** Actual local pre-handoff boundary. The controller must first fence SQL
+     * admission and later commit handoff before invoking withdrawOwnership.
+     * A failed preparation stays removed from the host loop and retains payloads. */
+    prepareDrain(roomId: string): Promise<RoomDrainHandoff>;
+    /** Trusted supervisor only, after matching durable handoff. Successful writes
+     * are remembered individually; failed native writes keep their retry lifetime. */
+    notifyDrainMigration(roomId: string, graceMs: number): Promise<void>;
+    private finishWithdrawal;
+    restore<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>>(checkpoint: RoomCheckpoint, descriptor: RoomDescriptor<S, I, O>, options: (O)["Type"], epoch: number, admission: RoomSeatAdmission, sessionOptions: RoomRuntimeSessionOptions, publicationHeld?: boolean): RoomActor<S, I, O>;
+    private capture;
+    private commitPending;
+    private retire;
+    private captureTerminal;
+    /** Resolve already accepted creation/retirement without advancing a Room.
+     * Terminal and hibernate jobs retain their original snapshot/command receipts.
+     * A failure in another Room cannot block this Room's pending commit. */
+    settleForDrain(roomId: string): Promise<'active' | 'retired'>;
+    private collectTerminal;
+    turn(): Promise<number>;
+    close(): Promise<void>;
+    retains(roomId: string): boolean;
+    isHibernating(roomId: string): boolean;
+    hasPendingCheckpoint(roomId: string): boolean;
+    metrics(): {
+        readonly loop: RoomHostLoopSnapshot;
+        readonly ownedRooms: number;
+        readonly pendingCheckpoints: number;
+        readonly sessions: number;
+        readonly checkpointCommits: number;
+        readonly checkpointStateBytes: number;
+        readonly unchangedSnapshotsSkipped: number;
+        readonly snapshotDeferred: number;
+        readonly snapshotForcedBytes: number;
+        readonly snapshotPeriodicBytes: number;
+        readonly snapshotDebtBytes: number;
+        /** Connected sessions whose state rate is reduced now, and how often their rates were halved. */
+        readonly throttledSessions: number;
+        readonly clientThrottles: number;
+        /** Inputs of connected sessions dropped for arriving later than the input latency budget. */
+        readonly staleInputsDropped: number;
+        /** Highest datagram loss a connected client reports (permille; null when none reported), and how many report 10 % or more. */
+        readonly maxReportedLossPermille: number | null;
+        readonly lossySessions: number;
+    };
+}
+
+export declare interface RoomRuntimeLockstepBinding {
+    readonly terminal: Context.Service.Shape<typeof RoomLockstepTerminalPort>;
+    readonly runEffect: RoomSnapshotEffectRunner;
+}
+
+declare interface RoomRuntimeSessionOptions extends Omit<RoomServerSessionOptions, 'epoch'> {
+    readonly spectatorGroup?: RoomSpectatorGroup | undefined;
+    readonly replayRecording?: RoomReplayRecordingBinding | undefined;
+    readonly geometry?: RoomGeometryResource | undefined;
+}
+
+declare interface RoomRuntimeSnapshotOptions {
+    readonly poolDefaults?: RoomPoolRuntimeDefaults | undefined;
+    readonly snapshotBudget?: RoomSnapshotBudgetOptions | undefined;
+    readonly snapshotBudgetFactory?: RoomSnapshotBudgetFactory;
+}
+
+declare type RoomScalar = string | number | boolean | null;
+
+declare interface RoomScheduler {
+    after(milliseconds: number, label: string): void;
+    every(milliseconds: number, label: string): void;
+    cancel(label: string): void;
+}
+
+declare interface RoomScheduleSnapshot {
+    readonly label: string;
+    readonly remainingMs: number;
+    readonly intervalMs: number | null;
+}
+
+/** SQL-backed implementations must compare identity/epoch/expiry and transition
+ * reserved -> connected atomically. A Redis-only consumed flag is insufficient:
+ * clearing hot data must never make a used credential reusable. */
+declare interface RoomSeatAdmission {
+    /** Actual SQL implementations recheck inside the Actor admission lifecycle. */
+    revalidate?(claims: RoomSeatClaims, credentialDigest: string): Effect.Effect<void, ProtocolError>;
+    consume(claims: RoomSeatClaims, credentialDigest: string): Effect.Effect<RoomConsumedSeat, SeatExpired | RoomForbidden | ProtocolError>;
+    disconnect(claims: RoomSeatClaims, reason: RoomLeaveReason, credentialDigest: string): Effect.Effect<void, ProtocolError>;
+}
+
+/** App data for one seat, resolved by the API when the seat is reserved (`seatAttributes`) and signed
+ * into it; scalars only, at most 16 keys and 2 KiB. */
+declare type RoomSeatAttributes = Readonly<Record<string, RoomScalar>>;
+
+declare type RoomSeatClaims = Omit<(typeof SeatClaimsSchema)["Type"], 'purpose'>;
+
+declare interface RoomSeatTokenStrategies {
+    readonly sign: typeof signRoomSeat;
+    readonly verify: typeof verifiedRoomSeatClaims;
+}
+
+/** Gateway-facing authority boundary. Every transport/seat operation happens
+ * outside RoomActor.advance; the actor receives memory-only client callbacks. */
+declare class RoomServerSession<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> {
+    private readonly owner;
+    readonly transport: RoomTransport;
+    readonly clock: RoomClock;
+    readonly seats: RoomSeatAdmission;
+    readonly options: RoomServerSessionOptions;
+    private readonly codecs;
+    private readonly baselines;
+    private readonly detach;
+    private readonly writes;
+    private readonly maxPendingWrites;
+    private readonly maxFramesPerSecond;
+    private phase;
+    private claims;
+    private credentialDigest;
+    private memberJoined;
+    private welcomeDelivered;
+    private datagramsAdmitted;
+    private resync;
+    private readonly worldNotices;
+    private worldNoticeStateFence;
+    private lastSentTick;
+    private lastSentAt;
+    private repairedTick;
+    private lastAckSeq;
+    private lastAckTick;
+    private sendLevel;
+    private sendSkip;
+    private sendThrottles;
+    private deltaDatagramsSent;
+    private reportedLossPermille;
+    private staleInputsDropped;
+    private closeTask;
+    private closeFailure;
+    private readonly localCleanupFailures;
+    private ownershipLost;
+    private drainRequested;
+    private drainTask;
+    private drainSettled;
+    private deferredClose;
+    private authTask;
+    private terminalError;
+    private frameTokens;
+    private byteTokens;
+    private replenishedAt;
+    private viewDurationMs;
+    private viewOverruns;
+    private readonly lifecycleAbort;
+    private readonly helloTimeoutMs;
+    private readonly authTimeoutMs;
+    private readonly idleTimeoutMs;
+    private readonly connectedAt;
+    private lastReceivedAt;
+    private authenticatingAt;
+    private authSettled;
+    private closeSettled;
+    private readonly seatToken;
+    private readonly spectatorHistory;
+    private delayedCursor;
+    private delayedTask;
+    private readonly authorizeWorldPlayer;
+    private readonly authorizeWorldTarget;
+    private readonly revalidateSeat;
+    private readonly onClientMessage;
+    private lockstepBinding;
+    private lockstepActivated;
+    constructor(owner: RoomActor<S, I, O> | RoomLockstepMemberOwner<S, I, O>, transport: RoomTransport, clock: RoomClock, seats: RoomSeatAdmission, options: RoomServerSessionOptions);
+    get actor(): RoomActor<S, I, O>;
+    get membershipMode(): 'state-sync' | 'lockstep';
+    get status(): 'awaitingHello' | 'authenticating' | 'joined' | 'closed';
+    get failure(): unknown;
+    teardownReady(): boolean;
+    /** The ordinary token gateway consumes Hello before installing listeners.
+     * Its verified frame is replayed once into this same admission path. */
+    admitFirstFrame(bytes: Uint8Array): void;
+    /** Called by the one host driver, outside actor.advance. No per-session timer. */
+    maintenance(): void;
+    metrics(): {
+        readonly viewDurationMs: number;
+        readonly viewOverruns: number;
+        readonly pendingWrites: number;
+    };
+    private snapshot;
+    private write;
+    private writeEncoded;
+    private send;
+    private backgroundClose;
+    private authenticate;
+    private receive;
+    private acknowledgeBaseline;
+    /** Invoke after the host's synchronous advance, at the configured send rate.
+     * Unacknowledged/stale baselines always fall back to a reliable full state. */
+    /** A room that stops changing publishes nothing newer, so a lost datagram carrying its last
+     * state would never be replaced. Once that state stays unacknowledged past the repair delay,
+     * it goes once more on the reliable stream. */
+    private repairUnacknowledgedState;
+    publishState(): void;
+    /** One slow client never slows the Room: while its unsent bytes exceed four frames of the
+     * Room's byte budget (`budgets.bytesPerSecond / sendRate × 4`), its state rate halves, down
+     * to every 8th frame; once they fall to half of that, it climbs back one step per frame
+     * sent. Skipped deltas fold into the next one, which still builds on an acknowledged
+     * baseline. */
+    private backpressured;
+    /** Input age: `tickHint` is the newest tick the client had when it acted. Measured against
+     * the newest state this Host sent that client (not the Room clock), so an idle Room or a
+     * throttled client never ages its inputs; only inputs that arrived after more than
+     * `budgets.inputLatencyBudgetMs` of newer state was already on its way are dropped. On the
+     * datagram lane a sent state may never arrive, so the age counts from the newest state the
+     * client acknowledged: a lost datagram does not make its inputs late, while a client that
+     * acknowledged newer state and claims an older one still is. */
+    private staleInput;
+    /** Inputs dropped for arriving later than `budgets.inputLatencyBudgetMs`. */
+    staleInputs(): number;
+    /** Adaptive send rate: the current level (0 = every frame, 3 = every 8th) and how often it rose. */
+    sendThrottle(): {
+        readonly level: number;
+        readonly throttles: number;
+    };
+    /** The client's last reported loss of state datagrams in permille, or null before its first report. */
+    reportedLoss(): number | null;
+    get id(): string | null;
+    /* Excluded from this release type: canSendLockstepMessages */
+    /* Excluded from this release type: sendLockstepMessage */
+    /* Excluded from this release type: writeReliableChannel */
+    /** Host-private observation after real token/SQL/member/Welcome admission.
+     * Native buffer drain is not a remote asset ACK or application authorization. */
+    /** Host operator kick: the Kick frame, then a `kicked` close that releases the seat instead of holding reconnect grace. */
+    kick(reason: string): Promise<void>;
+    admittedIdentity(): RoomSessionAdmissionEvidence | null;
+    /** Server-private compiled input layout, only while the same real admission is current. */
+    admittedInputSchemaHash(): number | null;
+    /* Excluded from this release type: installLockstep */
+    /* Excluded from this release type: canInstallLockstep */
+    /* Excluded from this release type: writeLockstep */
+    /* Excluded from this release type: withdrawLockstep */
+    private observerNow;
+    private publishDelayedState;
+    close(reason?: RoomLeaveReason): Promise<void>;
+    /** Stop new frames immediately; retain native connection and SQL Seats.
+     * Accepted auth/lifecycle/writes settle before a final snapshot may be taken.
+     * Only post-revocation closeFenced or explicit terminal disposal releases it. */
+    quiesceForDrain(): Promise<void>;
+    /** Trusted supervisor only, after the matching SQL handoff. */
+    /** Enqueue only; transport failures use the existing owned teardown path. */
+    notifyWorldHandoff(frame: RoomWorldHandoffFrame): void;
+    notifyMigration(graceMs: number, address?: string): Promise<void>;
+    /** Native fixtures/host shutdown can await all owned asynchronous work. */
+    settled(): Promise<void>;
+    /** Trusted supervisor only, after durable ownership revocation. It does not
+     * release/rotate a successor's SQL seat. Accepted auth and writes still await
+     * real completion; author, detach and transport failures remain failures. */
+    closeFenced(): Promise<void>;
+}
+
+declare interface RoomServerSessionHandle {
+    /** Optional provider capability; missing refuses readiness, never substitutes
+     * a sessionId/status-only success. Native RoomServerSession supplies it. */
+    admittedIdentity?(): RoomSessionAdmissionEvidence | null;
+    /** Optional provider capability for Host operator kicks; missing refuses the kick. */
+    kick?(reason: string): Promise<void>;
+    readonly id: string | null;
+    readonly status: 'awaitingHello' | 'authenticating' | 'joined' | 'closed';
+    readonly failure: unknown;
+    maintenance(): void;
+    teardownReady(): boolean;
+    admitFirstFrame(bytes: Uint8Array): void;
+    publishState(): void;
+    /** Optional: adaptive send-rate observation (native RoomServerSession supplies it). */
+    sendThrottle?(): {
+        readonly level: number;
+        readonly throttles: number;
+    };
+    /** Optional: inputs dropped for arriving later than the Room's input latency budget. */
+    staleInputs?(): number;
+    /** Optional: the client's last reported loss of state datagrams in permille (null before a report). */
+    reportedLoss?(): number | null;
+    close(reason?: 'left' | 'kicked' | 'reconnecting' | 'timeout' | 'disposed'): Promise<void>;
+    closeFenced(): Promise<void>;
+    quiesceForDrain?(): Promise<void>;
+    notifyWorldHandoff?(frame: RoomWorldHandoffFrame): void;
+    notifyMigration?(graceMs: number, address?: string): Promise<void>;
+    settled(): Promise<void>;
+}
+
+declare interface RoomServerSessionOptions {
+    /** Ordinary World player admission; returns the entity this Session controls for `onJoin`. */
+    readonly authorizeWorldPlayer?: (claims: RoomSeatClaims) => Effect.Effect<RoomWorldMember | undefined, ProtocolError>;
+    readonly authorizeWorldTarget?: (claims: RoomSeatClaims, binding: WorldTargetSeatBinding, credentialDigest: string) => Effect.Effect<'pending' | 'committed' | 'settled', ProtocolError>;
+    readonly epoch: number;
+    readonly secrets: SessionSecrets;
+    readonly epochNow: () => number;
+    readonly seatToken?: Partial<RoomSeatTokenStrategies>;
+    readonly maxPendingWrites?: number | undefined;
+    readonly maxFramesPerSecond?: number | undefined;
+    readonly baselineCapacity?: number | undefined;
+    readonly maxBaselineAgeMs?: number | undefined;
+    readonly helloTimeoutMs?: number;
+    readonly authTimeoutMs?: number;
+    readonly idleTimeoutMs?: number;
+    readonly onClientMessage?: (channel: string, payload: unknown, claims: RoomSeatClaims) => undefined;
+    readonly spectatorHistory?: RoomSpectatorHistory | undefined;
+}
+
+/** Server-private admitted player identity. It grants no application authority
+ * and must never appear in inspection, logs, exports or client payloads. */
+declare interface RoomSessionAdmissionEvidence {
+    readonly tenantId: string;
+    readonly subjectId: string;
+    readonly roomId: string;
+    readonly sessionId: string;
+    readonly epoch: number;
+    readonly role: 'player';
+    readonly nonce: string;
+    readonly credentialDigest: string;
+}
+
+declare type RoomSnapshotBudgetFactory = (options: Readonly<RoomSnapshotBudgetOptions>) => RoomSnapshotBudgetService;
+
+declare interface RoomSnapshotBudgetOptions {
+    readonly budgetBytesPerSec?: number;
+    readonly burstBytes?: number;
+}
+
+declare interface RoomSnapshotBudgetService {
+    /** Account a durable boundary without dropping commands/initial/terminal
+     * state. Its debt defers subsequent periodic snapshots. */
+    forced(bytes: number, now: number): void;
+    periodic(roomId: string, bytes: number, now: number): boolean;
+    /** A blocked periodic head cannot be bypassed by smaller periodic payloads. */
+    blocked(roomId: string): boolean;
+    forget(roomId: string): void;
+    metrics(): {
+        readonly deferred: number;
+        readonly forcedBytes: number;
+        readonly periodicBytes: number;
+        readonly debtBytes: number;
+    };
+}
+
+declare type RoomSnapshotEffectRunner = <A, E>(effect: Effect.Effect<A, E>) => Promise<A>;
+
+declare interface RoomSnapshotPolicy<S> {
+    readonly everyMs: number;
+    readonly onlyIfChanged: boolean;
+    readonly mode: 'full' | 'delta';
+    readonly fullEvery: number;
+    readonly keepFulls: number;
+    readonly store: 'auto';
+    /** Maximum inline codec payload; the host may impose a smaller cutoff. */
+    readonly maxInlineBytes: number;
+    /** Full-schema projection of volatile data; never a partial-state format. */
+    readonly pick: (state: S) => S;
+}
+
+/** One trusted common view, deliberately without a fabricated player identity.
+ * The app must authorize every reader to this entire view and withdraw it on
+ * privacy changes. No player-supplied group ID, view or clock is accepted. */
+declare interface RoomSpectatorGroup<S extends Schema.Codec<unknown, unknown> = Schema.Codec<unknown, unknown>> {
+    readonly view: (context: RoomSpectatorViewContext<(S)["Type"]>) => (S)["Type"];
+    readonly authorize: RoomSpectatorHistory['authorize'];
+}
+
+declare interface RoomSpectatorHistory {
+    readonly roomId: string;
+    readonly tenantId: string;
+    readonly history: SpectatorDelayBuffer<Schema.Codec<unknown, unknown>>;
+    /** Current author-owned admission to this exact view group, outside ticks. */
+    readonly authorize: (claims: RoomSeatClaims) => Effect.Effect<void, ProtocolError | RoomForbidden>;
+}
+
+declare interface RoomSpectatorPolicy {
+    readonly delayMs: number;
+    readonly retentionMs: number;
+    readonly maxFrames: number;
+    readonly maxBytes: number;
+    readonly maxFrameBytes: number;
+    readonly checkpointEveryMs: number;
+    readonly maxDeliveryFrames: number;
+}
+
+declare interface RoomSpectatorViewContext<A> {
+    readonly roomId: string;
+    readonly tenantId: string;
+    readonly epoch: number;
+    readonly tick: number;
+    readonly state: A;
+}
+
+/** Plain mutable state; the author receives no store or database capability. */
+declare type RoomState<A> = A extends ReadonlyArray<infer V> ? Array<RoomState<V>> : A extends object ? {
+    -readonly [K in keyof A]: RoomState<A[K]>;
+} : A;
+
+/** Input and channel schemas are not state schemas: sorted field names derive
+ * their binary order, while server state always requires explicit field IDs. */
+declare class RoomStateCodec<S extends Schema.Codec<unknown, unknown>> {
+    readonly schema: S;
+    private readonly codec;
+    constructor(schema: S, config?: Partial<RoomCodecLimits>);
+    get schemaHash(): number;
+    get limits(): RoomCodecLimits;
+    /** Canonical binary layout, including quantization and static movement rules.
+     * This is descriptive data; it grants neither authority nor a schema loader. */
+    schemaDescription(): string;
+    fieldManifest(): ReadonlyArray<RoomStateField>;
+    transformRulesManifest(): ReadonlyArray<RoomStateTransformRules>;
+    full(state: (S)["Type"]): Result.Result<Uint8Array, ProtocolError>;
+    decodeFull(bytes: Uint8Array): Result.Result<(S)["Type"], ProtocolError>;
+    delta(state: (S)["Type"], baseline: (S)["Type"], includeUnchanged?: boolean): Result.Result<Uint8Array | null, ProtocolError>;
+    decodeDelta(bytes: Uint8Array, baseline: (S)["Type"]): Result.Result<(S)["Type"], ProtocolError>;
+}
+
+declare interface RoomStateField {
+    /** Parent scope is formed from field IDs, not mutable author field names. */
+    readonly scope: string;
+    readonly id: number;
+    readonly name: string;
+}
+
+declare interface RoomStateTransformRules {
+    readonly scope: string;
+    readonly rules: TransformRules;
+}
+
+declare interface RoomStoredReplay {
+    readonly replayId: string;
+    readonly roomId: string;
+    readonly roomName: string;
+    readonly matchId: string;
+    readonly visibility: RoomReplayPublish['visibility'];
+    readonly expiresAtMs: number | null;
+    readonly durationMs: number;
+    readonly size: number;
+    readonly schemaHash: number;
+}
+
+/** Synchronous hook. `void` admits parameterless block bodies (TypeScript cannot narrow those to
+ * `undefined`); any returned value, a Promise included, is refused at runtime with an authoring error. */
+declare type RoomSyncHook<C> = (context: C) => void;
+
+declare interface RoomTickContext<S, I> {
+    /** Prepared native CPU queries only, installed before actor lifecycle. */
+    readonly geometry?: GeometryWorldView | undefined;
+    readonly state: RoomState<S>;
+    readonly tick: number;
+    readonly dt: number;
+    readonly inputs: ReadonlyArray<RoomInput<I>>;
+    readonly app: RoomAppBridge;
+    readonly clock: RoomClock;
+    readonly scheduler: RoomScheduler;
+    broadcast(channel: string, payload: unknown): void;
+}
+
+declare interface RoomTransport {
+    readonly name: 'ws' | 'wt';
+    readonly reliable: RoomReliableLane;
+    readonly unreliable?: RoomDatagramLane | undefined;
+    readonly signal: AbortSignal;
+    stats(): {
+        readonly rttMs: number | null;
+        readonly queuedBytes: number;
+        readonly droppedDatagrams: number;
+    };
+    close(code: number, reason: string): void;
+    /** When provided, joins actual parent/stream withdrawal and permits retry.
+     * Synchronous close alone does not establish native terminal evidence. */
+    closeAsync?(code: number, reason: string): Promise<void>;
+}
+
+declare interface RoomViewContext<S> {
+    readonly state: S;
+    readonly client: Pick<RoomClient, 'sessionId' | 'subjectId' | 'tenantId' | 'isBot' | 'countsAsPlayer' | 'attributes'>;
+    readonly role: 'player' | 'spectator';
+    readonly tick: number;
+}
+
+/** World Rooms keep their authored entities in the declared state record. */
+declare type RoomWorldEntity<S> = S extends {
+    readonly entities: Readonly<Record<string, infer E>>;
+} ? RoomState<E> & {
+    readonly id: string;
+} : never;
+
+/** Internal source handoff identity; caller data never replaces the live entity. */
+declare interface RoomWorldExitInput {
+    readonly afterglow?: {
+        readonly requestId: string;
+        readonly expiresAt: number;
+    };
+    readonly subjectId?: string;
+    readonly epoch: number;
+    readonly entityId: string;
+    readonly requestId: string;
+    readonly location: WorldEntityLocation;
+}
+
+/** Render/connection coordination only: no token and no ownership assertion. */
+declare interface RoomWorldHandoffFrame {
+    readonly kind: 'WorldHandoff';
+    readonly phase: 'departed' | 'cancelled';
+    readonly transitionId: string;
+    readonly entityId: string;
+    readonly tick: number;
+    readonly sourceEpoch: number;
+    readonly targetRoomId: string;
+    readonly targetEpoch: number;
+    readonly holdMs: number;
+}
+
+declare interface RoomWorldHookContext<S> {
+    readonly state: RoomState<S>;
+    readonly phase: 'prepare' | 'commit' | 'rollback';
+    readonly requestId?: string | undefined;
+    readonly entity: RoomWorldEntity<S>;
+}
+
+declare interface RoomWorldHookInput<E = unknown> {
+    /** Actual target placement, distinct from the source location. Only guarded
+     * target entry uses it; source rollback must restore its exact snapshot. */
+    readonly arrival?: WorldEntityLocation;
+    readonly epoch: number;
+    readonly entity: E;
+    readonly location: WorldEntityLocation;
+    readonly requestId?: string | undefined;
+}
+
+declare interface RoomWorldHooks<S> {
+    /** Opt-in cell movement: synchronous author projection/write, no I/O. */
+    readonly movement?: RoomWorldMovement<S>;
+    /** Retained checkpoint receipts awaiting confirmed transition retirement. */
+    readonly maxPendingTransitions?: number;
+    readonly onEnter: RoomLifecycleHook<RoomWorldHookContext<S> & {
+        readonly from: WorldEntityLocation;
+        readonly to?: WorldEntityLocation;
+    }>;
+    readonly onExit: RoomLifecycleHook<RoomWorldHookContext<S> & {
+        readonly to: WorldEntityLocation;
+    }>;
+    /** Publish a projection on commit; remove that projection on rollback. Never
+     * promote it into authoritative entities. Rollback may retry after failure. */
+    readonly onGhost: RoomLifecycleHook<RoomWorldHookContext<S>>;
+    /** Synchronous, bounded JSON projection; no SQL or asynchronous effect here. */
+    readonly persistEntity: (context: {
+        readonly entity: RoomWorldEntity<S>;
+    }) => unknown;
+    /** A player who arrived by a World transition is now an active member. `onJoin` does not run for
+     * such arrivals (the entity came with `onEnter`); this is where the Room sees the arriving client,
+     * e.g. its seat attributes (`client.attributes`). */
+    readonly onMemberEnter?: RoomLifecycleHook<{
+        readonly state: RoomState<S>;
+        readonly client: RoomClient;
+        readonly entityId: string;
+    }>;
+}
+
+/** The server-owned entity an ordinary World player Session controls, as last persisted.
+ * The Room's `onJoin` receives it as `world` and builds the state entity when absent. */
+declare interface RoomWorldMember {
+    readonly entityId: string;
+    readonly worldId: string;
+    readonly zoneId: string;
+    readonly cellId: string;
+    readonly layer: number;
+    readonly revision: number;
+    /** The Room's `persistEntity` projection from the entity's last write. */
+    readonly data: unknown;
+}
+
+declare interface RoomWorldMovement<S> {
+    readonly maxEntities: number;
+    readonly maxBytesPerTick: number;
+    readonly position: (entity: RoomWorldEntity<S>) => WorldPoint;
+    readonly move: (entity: RoomWorldEntity<S>, at: WorldPoint) => void;
+}
+
+declare interface RoomWorldReceipt {
+    readonly requestId: string;
+    readonly operation: 'enter' | 'exit' | 'ghost';
+    readonly fingerprint: string;
+    readonly projection?: {
+        readonly entity: unknown;
+        readonly location: WorldEntityLocation;
+        readonly expiresAt?: number;
+    };
+}
+
+declare const SeatClaimsSchema: Schema.Struct<{
+    readonly purpose: Schema.Literal<"voltro.rooms.seat.v1">;
+    readonly roomId: Schema.NonEmptyString;
+    readonly sessionId: Schema.NonEmptyString;
+    readonly subjectId: Schema.NullOr<Schema.NonEmptyString>;
+    readonly subjectType: Schema.optionalKey<Schema.Literals<readonly ["user", "apiKey", "serviceAccount"]>>;
+    readonly subjectKind: Schema.optionalKey<Schema.Literal<"guest">>;
+    readonly tenantId: Schema.NonEmptyString;
+    readonly epoch: Schema.Int;
+    readonly nonce: Schema.NonEmptyString;
+    readonly expiresAt: Schema.Number;
+    readonly role: Schema.Literals<readonly ["player", "spectator"]>;
+    readonly attributes: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Union<readonly [Schema.String, Schema.Number, Schema.Boolean, Schema.Null]>>>;
+}>;
+
+declare class SeatExpired extends SeatExpired_base {
+}
+
+declare const SeatExpired_base: Schema.Class<SeatExpired, Schema.TaggedStruct<"SeatExpired", {
+    readonly sessionId: Schema.String;
+}>, YieldableError>;
+
+/** The caller supplies project-owned Rooms keys, never API-session keys.
+ * This is the ordinary framework HMAC primitive with a dedicated purpose and
+ * identity carrier, not an additional signature implementation. */
+declare const signRoomSeat: (claims: RoomSeatClaims, secrets: SessionSecrets, nowMs: number) => Uint8Array;
+
+declare interface Simulation<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> {
+    readonly definition: SimulationDefinition<S, I, O>;
+    readonly stateCodec: SimulationStateCodec<S>;
+    readonly inputCodec: SimulationStateCodec<I>;
+    readonly optionsCodec: SimulationStateCodec<O>;
+}
+
+declare interface SimulationDefinition<S extends Schema.Codec<unknown, unknown>, I extends Schema.Codec<unknown, unknown>, O extends Schema.Codec<unknown, unknown>> {
+    readonly state: S;
+    readonly input: I;
+    readonly options: O;
+    readonly init: (seed: number, options: (O)["Type"]) => (S)["Type"];
+    readonly step: (state: RoomState<(S)["Type"]>, inputs: ReadonlyArray<SimulationPlayerInput<(I)["Type"]>>, tick: number, rng: Pcg32) => (S)["Type"];
+    readonly hash?: (state: (S)["Type"]) => Uint64Words;
+    /** Late join: runs before `step` at the tick a player's input first appears (it was absent
+     * from the previous tick's inputs), in player-ID order, e.g. to spawn the player. Pure and
+     * deterministic like `step`. Start players are `init`'s job: tick 1 runs no join. */
+    readonly join?: (state: RoomState<(S)["Type"]>, playerId: number, tick: number, rng: Pcg32) => (S)["Type"];
+    readonly limits?: Partial<SimulationValueLimits>;
+}
+
+declare interface SimulationPlayerInput<I> {
+    readonly playerId: number;
+    readonly input: I;
+}
+
+declare interface SimulationRecovery<S, I> {
+    readonly snapshot: SimulationSnapshot<S>;
+    readonly inputs: ReadonlyArray<SimulationPlayerInput<I>>;
+    readonly continuation?: ReadonlyArray<SimulationTickInputs<I>> | undefined;
+}
+
+declare interface SimulationSnapshot<S> {
+    readonly tick: number;
+    readonly state: S;
+    readonly rng: Pcg32Snapshot;
+    readonly hash: Uint64Words;
+}
+
+declare interface SimulationStateCodec<S extends Schema.Codec<unknown, unknown>> {
+    readonly limits: SimulationValueLimits;
+    /** Admitted capture/hash plan, not a binary Room wire schema. */
+    schemaDescription?(): string;
+    capture(value: unknown): (S)["Type"];
+    hash(value: (S)["Type"]): Uint64Words;
+}
+
+declare interface SimulationTickInputs<I> {
+    readonly tick: number;
+    readonly inputs: ReadonlyArray<SimulationPlayerInput<I>>;
+}
+
+declare interface SimulationValueLimits extends RoomCodecLimits {
+    readonly maxNodes: number;
+}
+
+/** One already-authorized view group's contiguous Full/Delta history. Feed and
+ * delivery happen outside ticks. This does not install a spectator or timer. */
+declare class SpectatorDelayBuffer<S extends Schema.Codec<unknown, unknown>> {
+    private readonly codec;
+    readonly limits: SpectatorDelayLimits;
+    private records;
+    private previous;
+    private checkpointAt;
+    private sequence;
+    private observedNow;
+    private cached;
+    constructor(codec: RoomStateCodec<S>, limits?: Partial<SpectatorDelayLimits>);
+    /** Exact selected-view layout; it grants no group/seat authority. */
+    schemaDescription(): string;
+    append(atMs: number, input: Uint8Array): Result.Result<void, ProtocolError>;
+    delivery(nowMs: number, after?: SpectatorDelayCursor): Result.Result<SpectatorDelayDelivery, ProtocolError>;
+    /** No previously returned frame or external peer is erased by this call. */
+    clear(): void;
+}
+
+/** Opaque history position only; never a seat, credential or authorization. */
+declare interface SpectatorDelayCursor {
+    readonly sequence: number;
+    readonly tick: number;
+    readonly epoch: number;
+}
+
+declare type SpectatorDelayDelivery = {
+    readonly kind: 'unavailable';
+} | {
+    readonly kind: 'unchanged';
+    readonly cursor: SpectatorDelayCursor;
+    readonly atMs: number;
+} | {
+    readonly kind: 'full';
+    readonly cursor: SpectatorDelayCursor;
+    readonly atMs: number;
+    readonly bytes: Uint8Array;
+} | {
+    readonly kind: 'deltas';
+    readonly cursor: SpectatorDelayCursor;
+    readonly atMs: number;
+    readonly frames: ReadonlyArray<{
+        readonly atMs: number;
+        readonly bytes: Uint8Array;
+    }>;
+};
+
+declare type SpectatorDelayLimits = RoomSpectatorPolicy;
+
+declare const Transform2D: Schema.Struct<{
+    readonly x: Schema.Number;
+    readonly y: Schema.Number;
+    readonly rot: Schema.Number;
+    readonly vx: Schema.optional<Schema.Number>;
+    readonly vy: Schema.optional<Schema.Number>;
+}>;
+
+declare type Transform2D = (typeof Transform2D)["Type"];
+
+declare type TransformRules = TransformRules2D | TransformRules3D;
+
+declare interface TransformRules2D {
+    readonly bounds: {
+        readonly min: readonly [number, number];
+        readonly max: readonly [number, number];
+    };
+    readonly maxSpeed: number;
+    readonly maxAccel: number;
+    readonly precision: number;
+    readonly rotation?: {
+        readonly bits: number;
+    } | undefined;
+    readonly velocity?: 'send' | 'derive' | 'none' | undefined;
+    readonly interpolation: 'linear' | 'hermite' | 'none';
+    readonly extrapolateMs: number;
+    readonly teleportThreshold: number;
+}
+
+declare interface TransformRules3D {
+    readonly bounds: {
+        readonly min: readonly [number, number, number];
+        readonly max: readonly [number, number, number];
+    };
+    readonly maxSpeed: number;
+    readonly maxAccel: number;
+    readonly precision: number;
+    readonly rotation?: {
+        readonly bits: number;
+    } | undefined;
+    readonly interpolation: 'linear' | 'hermite' | 'none';
+    readonly extrapolateMs: number;
+    readonly teleportThreshold: number;
+}
+
+/** Exact unsigned 64-bit integer as independent 32-bit words. */
+declare interface Uint64Words {
+    readonly hi: number;
+    readonly lo: number;
+}
+
+/** Signature, purpose and exact millisecond expiry are checked before any
+ * durable seat operation. A valid token grants no application scopes. */
+declare const verifiedRoomSeatClaims: (token: Uint8Array, secrets: SessionSecrets, nowMs: number) => RoomSeatClaims;
+
+declare type WorldBounds = readonly [minimum: WorldPoint, maximum: WorldPoint];
+
+declare interface WorldDefinition<Player> {
+    readonly name: string;
+    readonly map: {
+        readonly bounds: WorldBounds;
+    };
+    readonly zones: ReadonlyArray<WorldZone>;
+    readonly instances?: ReadonlyArray<WorldInstance>;
+    readonly persistence: {
+        readonly entities: 'world';
+        readonly snapshotEveryMs: number;
+        readonly journal: boolean;
+    };
+    readonly handoff: {
+        readonly marginUnits: number;
+        readonly ghostUnits: number;
+    };
+    readonly spawn: (context: {
+        readonly player: Player;
+    }) => WorldPosition;
+    readonly geometry?: WorldGeometryDefinition | undefined;
+    readonly hosts?: {
+        readonly pool: string;
+    };
+    readonly characters?: 'shared' | 'per-world';
+    readonly transitionCooldownMs?: number;
+    /** Authoring inventory bounds, not measured runtime capacity. */
+    readonly budgets?: {
+        readonly maxZones?: number;
+        readonly maxCells?: number | undefined;
+        readonly maxInstances?: number;
+    };
+    readonly strategies?: {
+        readonly layerPolicy?: WorldLayerPolicy | undefined;
+        readonly transitionPolicy?: WorldTransitionPolicy;
+        readonly onWorldChange?: WorldOnWorldChange;
+    };
+}
+
+declare interface WorldDescriptor<Player> extends Omit<WorldDefinition<Player>, 'instances' | 'budgets' | 'characters' | 'transitionCooldownMs' | 'strategies' | 'geometry'> {
+    readonly geometry?: WorldGeometryDescriptor | undefined;
+    readonly _tag: 'WorldDescriptor';
+    readonly instances: ReadonlyArray<Omit<WorldInstance, 'ttl'> & {
+        readonly ttlMs: number;
+    }>;
+    readonly budgets: {
+        readonly maxZones: number;
+        readonly maxCells: number;
+        readonly maxInstances: number;
+    };
+    readonly characters: 'shared' | 'per-world';
+    readonly transitionCooldownMs: number;
+    readonly cellCount: number;
+    readonly strategies: {
+        readonly layerPolicy: WorldLayerPolicy;
+        readonly transitionPolicy: WorldTransitionPolicy;
+        readonly onWorldChange: WorldOnWorldChange;
+    };
+}
+
+declare interface WorldEntityLocation {
+    readonly worldId: string;
+    readonly zoneId: string;
+    readonly at: WorldPoint;
+    readonly layer: number;
+    readonly roomId: string;
+    readonly epoch: number;
+}
+
+declare interface WorldGeometryDefinition {
+    readonly strategies?: WorldGeometryStrategies | undefined;
+    readonly kind: GeometryKind;
+    readonly static: GeometrySource;
+    readonly chunkSize?: number;
+    readonly dynamic?: {
+        readonly enabled?: boolean | undefined;
+        readonly maxDeltaBytesPerChunk?: number;
+        readonly persist?: {
+            readonly everyMs?: number;
+            readonly onUnload?: boolean;
+        };
+    };
+    readonly collision?: {
+        readonly derive?: 'bitgrid' | 'heightfield' | 'shapes';
+        readonly resolution?: number;
+    };
+    readonly nav?: {
+        readonly derive?: 'grid' | 'none';
+        readonly navBudgetMs?: number;
+        readonly maxAdvanceSteps?: number;
+    };
+    readonly streaming?: {
+        readonly client?: {
+            readonly radiusChunks?: number;
+            readonly prefetchChunks?: number;
+            readonly maxConcurrent?: number | undefined;
+            readonly maxCachedChunks?: number;
+        };
+        readonly cell?: {
+            readonly marginChunks?: number;
+        };
+    };
+    readonly lod?: ReadonlyArray<{
+        readonly beyondChunks: number;
+        readonly fields: ReadonlyArray<string>;
+    }>;
+    readonly budgets?: {
+        readonly maxPreparedChunks?: number;
+        readonly maxPreparedBytes?: number;
+        readonly maxLodLevels?: number;
+        readonly maxRayCells?: number | undefined;
+        readonly maxOverlapTests?: number | undefined;
+    };
+}
+
+declare interface WorldGeometryDescriptor {
+    readonly strategies: GeometryEditStrategies & GeometryDerivationStrategies & GeometryCompactionStrategies & {
+        readonly migrateDelta: GeometryMigrateDelta;
+    };
+    readonly _tag: 'WorldGeometry';
+    readonly kind: GeometryKind;
+    readonly static: GeometrySource;
+    readonly chunkSize: number;
+    readonly chunkSizeRaw: number;
+    readonly dynamic: {
+        readonly enabled: boolean;
+        readonly maxDeltaBytesPerChunk: number;
+        readonly persist: {
+            readonly everyMs: number;
+            readonly onUnload: boolean;
+        };
+    };
+    readonly collision: {
+        readonly derive: 'bitgrid' | 'heightfield' | 'shapes';
+        readonly resolution: number;
+        readonly resolutionRaw: number;
+    };
+    readonly nav: {
+        readonly derive: 'grid' | 'none';
+        readonly navBudgetMs: number;
+        readonly maxAdvanceSteps: number;
+    };
+    readonly streaming: {
+        readonly client: {
+            readonly radiusChunks: number;
+            readonly prefetchChunks: number;
+            readonly maxConcurrent: number;
+            readonly maxCachedChunks: number;
+        };
+        readonly cell: {
+            readonly marginChunks: number;
+        };
+    };
+    readonly lod: ReadonlyArray<{
+        readonly beyondChunks: number;
+        readonly fields: ReadonlyArray<string>;
+    }>;
+    readonly budgets: {
+        readonly maxPreparedChunks: number;
+        readonly maxPreparedBytes: number;
+        readonly maxLodLevels: number;
+        readonly maxRayCells: number;
+        readonly maxOverlapTests: number;
+    };
+}
+
+declare interface WorldGeometryStrategies extends GeometryVersionMigrationStrategies, Partial<GeometryEditStrategies>, Partial<GeometryDerivationStrategies>, Partial<GeometryCompactionStrategies> {
+}
+
+declare interface WorldInstance {
+    readonly id: string;
+    readonly room: string;
+    readonly maxGroups: number;
+    readonly ttl: Duration.Input;
+}
+
+declare type WorldLayerDecision = {
+    readonly kind: 'use';
+    readonly layer: number;
+    readonly wake: boolean;
+} | {
+    readonly kind: 'create';
+    readonly layer: number;
+} | {
+    readonly kind: 'blocked';
+    readonly reason: 'affinity-unavailable' | 'capacity' | 'layer-budget';
+};
+
+declare interface WorldLayering {
+    readonly maxPlayers: number;
+    readonly splitAt: number;
+    readonly mergeBelow: number;
+}
+
+declare interface WorldLayerInput {
+    readonly policy: WorldLayering;
+    readonly layers: ReadonlyArray<WorldLayerObservation>;
+    readonly groupSize: number;
+    /** Actual server-owned party affinity; never silently choose a different layer. */
+    readonly affinity: number | null;
+    readonly maxLayers: number;
+}
+
+declare interface WorldLayerObservation {
+    readonly layer: number;
+    readonly players: number;
+    readonly state: 'live' | 'hibernated' | 'splitting' | 'merging';
+}
+
+declare type WorldLayerPolicy = (input: WorldLayerInput) => WorldLayerDecision;
+
+declare interface WorldMovementIntent {
+    readonly entityId: string;
+    readonly sourceAt: WorldPoint;
+    readonly targetAt: WorldPoint;
+    readonly crossing: boolean;
+}
+
+declare interface WorldMovementObservation {
+    readonly epoch: number;
+    readonly tick: number;
+    readonly intents: ReadonlyArray<WorldMovementIntent>;
+}
+
+declare type WorldOnWorldChange = (input: WorldOnWorldChangeInput) => unknown;
+
+declare interface WorldOnWorldChangeInput {
+    readonly sourceWorldId: string;
+    readonly targetWorldId: string;
+    /** Current server-captured character data, never a player's wire state. */
+    readonly sourceData: unknown;
+    /** Actual server-selected target data before this policy. */
+    readonly targetData: unknown;
+}
+
+declare type WorldPoint = readonly [x: number, y: number];
+
+declare interface WorldPosition {
+    readonly zone: string;
+    readonly at: WorldPoint;
+}
+
+/** Private durable restriction, never a bearer or a grant of transition authority.
+ * The enclosing Seat supplies tenant, target Room, Subject and ownership epoch. */
+declare interface WorldTargetSeatBinding {
+    readonly transitionId: string;
+    readonly sourceRoomId: string;
+    readonly requestId: string;
+    readonly entityId: string;
+}
+
+declare type WorldTransitionKind = 'cell' | 'layer' | 'zone' | 'world' | 'instance' | 'return' | 'recover';
+
+declare interface WorldTransitionLocation extends WorldPosition {
+    readonly world: string;
+    readonly pool: string;
+    readonly layer: number;
+    readonly instance: string | null;
+}
+
+declare type WorldTransitionMode = 'seamless' | 'portal' | 'recover';
+
+declare interface WorldTransitionPlan {
+    readonly kind: WorldTransitionKind;
+    readonly mode: WorldTransitionMode;
+    readonly crossPool: boolean;
+    readonly persistBeforeRelease: boolean;
+    readonly sourceCell: string;
+    readonly targetCell: string;
+}
+
+declare type WorldTransitionPolicy = (input: WorldTransitionPolicyInput) => WorldTransitionPlan;
+
+declare interface WorldTransitionPolicyInput {
+    readonly kind: WorldTransitionKind;
+    readonly sourceWorld: AnyWorldDescriptor;
+    readonly targetWorld: AnyWorldDescriptor;
+    readonly source: WorldTransitionLocation;
+    readonly target: WorldTransitionLocation;
+    readonly mode: WorldTransitionMode | 'auto';
+    readonly crossPool: boolean;
+    /** Trusted server recovery classification, not a player intention field. */
+    readonly recovery: boolean;
+}
+
+declare interface WorldZone {
+    readonly id: string;
+    readonly bounds: WorldBounds;
+    readonly room: string;
+    readonly neighbors: ReadonlyArray<string>;
+    readonly cells?: {
+        readonly size: number;
+    } | undefined;
+    readonly layering?: WorldLayering;
+}
+
+export { }